CVE-2026-35228: Oracle MCP Server Helper Tool SQL Injection

CVE-2026-35228 Overview

CVE-2026-35228 is a SQL injection vulnerability [CWE-89] in the Oracle MCP Server Helper Tool, a component of Oracle Open Source Projects. The flaw affects versions 1.0.1 through 1.0.156 of the helper tool. An unauthenticated attacker with network access via HTTP can exploit the weakness to coerce the Oracle MCP Server Helper Tool into executing malicious SQL statements. Successful exploitation impacts both the confidentiality and integrity of the affected system, with a scope change indicating consequences extend beyond the vulnerable component itself. The issue requires user interaction to trigger, but the attack complexity remains low.

Critical Impact
Remote attackers can execute arbitrary SQL through the helper tool, exposing or modifying data accessible to the connected database context.

Affected Products

Oracle MCP Server Helper Tool versions 1.0.1 through 1.0.156
Oracle Open Source Projects (helper tool component)
Deployments exposing the helper tool over HTTP to untrusted networks

Discovery Timeline

2026-05-05 - CVE CVE-2026-35228 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-35228

Vulnerability Analysis

The Oracle MCP Server Helper Tool fails to properly neutralize special elements used in SQL commands, classified as [CWE-89]. The helper tool accepts attacker-controllable input via HTTP and concatenates or interpolates that input into SQL queries without adequate parameterization or escaping. Because the component is reachable over the network and authentication is not strictly required for the affected code paths, an external attacker can submit crafted requests that alter the structure of the underlying SQL statements.

The scope-changing nature of the issue indicates that successful injection affects resources beyond the helper tool's own security context, such as backend database objects governed by separate authorization. This expands the blast radius from the helper tool itself to data and operations available to the database account it uses.

Root Cause

The root cause is improper input neutralization in the SQL query construction logic of the helper tool. User-supplied values reach query execution paths without prepared statements, parameter binding, or strict allow-list validation. Any HTTP parameter that flows into a SQL string therefore becomes a potential injection point.

Attack Vector

An attacker delivers a crafted HTTP request to the Oracle MCP Server Helper Tool endpoint. User interaction is required, suggesting the attack may be triggered through a victim-initiated action such as following a malicious link or loading a page that issues the request. The injected SQL then executes under the privileges of the helper tool's database connection, enabling data extraction, modification, or invocation of database-resident functions.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.077%. See the Oracle CVE Security Alerts page for technical details.

Detection Methods for CVE-2026-35228

Indicators of Compromise

HTTP requests to Oracle MCP Server Helper Tool endpoints containing SQL meta-characters such as single quotes, --, ;, UNION SELECT, or OR 1=1 patterns.
Database audit log entries showing unexpected query structures, schema enumeration, or access to tables outside the helper tool's normal workflow.
Spikes in error responses or query execution latency from the helper tool tied to a specific source IP.

Detection Strategies

Deploy web application firewall (WAF) rules tuned to identify SQL injection payloads against the helper tool's HTTP routes.
Enable database-level auditing for queries originating from the helper tool service account and alert on anomalous statement shapes.
Correlate HTTP access logs with database audit trails to identify request-to-query patterns inconsistent with normal application behavior.

Monitoring Recommendations

Monitor outbound connections from the helper tool host for signs of data staging or exfiltration following suspicious HTTP activity.
Track failed and successful authentication events for the database account used by the helper tool, watching for privilege probing.
Alert on new or modified stored procedures, triggers, or accounts created in databases accessed by the helper tool.

How to Mitigate CVE-2026-35228

Immediate Actions Required

Inventory all deployments of the Oracle MCP Server Helper Tool and confirm whether installed versions fall within the affected range 1.0.1 to 1.0.156.
Restrict network access to the helper tool to trusted internal segments using firewall and network policy controls until a patched version is applied.
Reduce database privileges granted to the helper tool's service account to the minimum required for its function, limiting injection impact.

Patch Information

Oracle has not published a fixed version reference within the available NVD data. Administrators should consult the Oracle CVE Security Alerts page for the latest patch availability and upgrade guidance, and apply any release that supersedes version 1.0.156 once published.

Workarounds

Place the helper tool behind a reverse proxy or WAF configured to block SQL injection signatures on inbound HTTP requests.
Disable or remove the helper tool from production environments where its functionality is not required.
Rotate database credentials used by the helper tool after applying the patch to invalidate any credentials that may have been exposed through prior injection.

bash

# Configuration example: restrict helper tool access at the network layer
iptables -A INPUT -p tcp --dport <helper_tool_port> -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <helper_tool_port> -j DROP