CVE-2026-11529: mysql-mcp-server SQL Injection Flaw

CVE-2026-11529 Overview

CVE-2026-11529 is a SQL injection vulnerability in the designcomputer/mysql-mcp-server project through version 0.2.2. The flaw resides in the read_resource function of src/mysql_mcp_server/server.py, within the mysql URI handler component. Attackers can manipulate the uri_str argument to inject arbitrary SQL statements over the network. The vulnerability is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). A public exploit disclosure exists, and the project maintainer has released version 0.3.0 containing the fix in commit 080bef9a96d625ce0dfbde573a08b93497871981.

Critical Impact
Authenticated remote attackers can inject SQL commands through the MCP server URI handler, potentially exposing database contents to Model Context Protocol clients including AI assistants.

Affected Products

designcomputer mysql-mcp-server versions up to and including 0.2.2
Model Context Protocol (MCP) deployments embedding the affected mysql_mcp_server package
AI assistant integrations that route MySQL queries through the vulnerable URI handler

Discovery Timeline

2026-06-08 - CVE-2026-11529 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11529

Vulnerability Analysis

The mysql_mcp_server package implements a Model Context Protocol server that exposes MySQL databases to AI assistants. The read_resource function in src/mysql_mcp_server/server.py accepts a URI string (uri_str) from the MCP client and uses it to construct a SQL query against the backend database. The function does not properly neutralize special SQL characters before composing the query string. An attacker capable of submitting MCP resource requests can append or modify SQL clauses by crafting a malicious URI. The exploit requires low privileges and no user interaction, and remote network access is sufficient to trigger the flaw.

Root Cause

The root cause is improper neutralization of input passed to a downstream SQL interpreter, classified under CWE-74. The read_resource handler interpolates the uri_str parameter into a dynamic SQL statement instead of using parameterized queries or strict input validation against an allowlist of expected URI formats.

Attack Vector

Exploitation occurs over the network through the MCP transport channel. An attacker with access to submit resource requests to the MCP server crafts a mysql:// URI that embeds additional SQL syntax. When read_resource processes the URI, the injected SQL is executed against the backing MySQL instance under the credentials configured for the MCP server. The patch applied in version 0.3.0 adds container hardening and dependency upgrades alongside the input handling fix.

text

# Patch excerpt from pyproject.toml (commit 080bef9a)
[project]
 name = "mysql_mcp_server"
-version = "0.2.2"
+version = "0.3.0"
 dependencies = [
-    "mcp>=1.0.0",
+    "mcp>=1.2.0",
     "mysql-connector-python>=9.1.0",
 ]

Source: GitHub Commit 080bef9a

Detection Methods for CVE-2026-11529

Indicators of Compromise

MCP server logs containing mysql:// URIs with embedded SQL metacharacters such as single quotes, semicolons, UNION, or comment sequences (--, /*)
Unexpected MySQL queries originating from the mysql_mcp_server process that reference system tables like information_schema or mysql.user
Outbound connections from AI assistant or LLM agent infrastructure that invoke read_resource with abnormally long or malformed URIs

Detection Strategies

Inspect MCP request payloads at the application layer for URIs that contain SQL keywords outside the expected resource path syntax
Enable MySQL general query logging on databases backing the MCP server and alert on queries that deviate from the schema introspection patterns used by mysql_mcp_server
Compare deployed package versions against 0.3.0 using software composition analysis tooling and flag any instance pinned at or below 0.2.2

Monitoring Recommendations

Forward mysql_mcp_server stdout, stderr, and MySQL audit logs to a centralized log platform for correlation
Establish a baseline of legitimate read_resource URI patterns and alert on outliers in length, character distribution, or query verbs
Monitor MCP server processes for unexpected child processes or network connections that may indicate post-exploitation activity

How to Mitigate CVE-2026-11529

Immediate Actions Required

Upgrade mysql_mcp_server to version 0.3.0 or later, which includes commit 080bef9a96d625ce0dfbde573a08b93497871981
Restrict the MySQL account used by the MCP server to the minimum privileges required, removing write or administrative grants where possible
Place the MCP server behind authenticated transport and limit network reachability to trusted AI assistant clients only

Patch Information

The maintainer published release v0.3.0 containing the fix. The change is tracked in pull request #86 and issue #89. Additional vulnerability metadata is available at VulDB CVE-2026-11529.

Workarounds

If upgrading is not immediately feasible, disable the mysql URI resource handler or remove the read_resource route from the MCP server configuration
Run the MCP server as a non-root user inside a container and pass database credentials through runtime environment variables rather than baked-in secrets, as reflected in the v0.3.0 Dockerfile changes
Apply a reverse proxy or input validation layer in front of the MCP server that rejects URIs containing SQL metacharacters before they reach read_resource

bash

# Upgrade to the patched release
pip install --upgrade 'mysql_mcp_server>=0.3.0'

# Verify installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mysql_mcp_server'))"

# Container hardening reflected in v0.3.0
# Run as non-root user and pass secrets at runtime
docker run --rm \
  -e MYSQL_HOST=db.internal \
  -e MYSQL_USER=mcp_reader \
  -e MYSQL_PASSWORD="$MYSQL_PASSWORD" \
  mysql_mcp_server:0.3.0