CVE-2026-7591: astro-mcp-server SQL Injection Flaw

CVE-2026-7591 Overview

CVE-2026-7591 is a SQL injection vulnerability affecting TimBroddin astro-mcp-server versions up to 1.1.1. The flaw resides in an unidentified function within src/index.ts, specifically in the MCP Tool Query Construction component. Attackers can manipulate the request.params.arguments parameter to inject arbitrary SQL statements. The attack is exploitable remotely and requires only low-privileged access. A public exploit has been released, and the project maintainers have not responded to the issue report disclosing the flaw. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Remote attackers with low privileges can inject SQL statements through MCP tool arguments, compromising the confidentiality, integrity, and availability of backend data.

Affected Products

• TimBroddin astro-mcp-server versions up to and including 1.1.1
• Component: MCP Tool Query Construction (src/index.ts)
• Deployments exposing the MCP server to remote clients

Discovery Timeline

• 2026-05-01 - CVE-2026-7591 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-7591

Vulnerability Analysis

The vulnerability stems from unsafe handling of input passed through the Model Context Protocol (MCP) tool invocation interface. When the server receives a tool call, it extracts values from request.params.arguments and incorporates them directly into a SQL query inside src/index.ts. Because the implementation does not parameterize the query or sanitize the user-controlled fields, attackers can break out of the intended query context and append arbitrary SQL clauses.

The attack requires network access and authenticated low-privileged access to the MCP server. The exploit itself was disclosed publicly through the project's GitHub issue tracker, increasing the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is dynamic SQL query construction using untrusted input from MCP tool arguments without prepared statements or input validation. The astro-mcp-server concatenates client-supplied values into SQL strings, allowing injection of clauses such as UNION SELECT, comment delimiters, or stacked queries depending on the underlying database driver.

Attack Vector

An attacker connects to the MCP server as a low-privileged client and issues a crafted tool invocation. The malicious payload is placed inside the JSON arguments object of the MCP request. The server then composes the SQL statement using the unsanitized argument value, executing whatever SQL the attacker supplies. Because MCP servers commonly broker access to backend data sources for AI assistants, successful injection can expose data the LLM was supposed to retrieve through controlled channels. Refer to the VulDB Vulnerability Details and GitHub Issue Tracker for additional technical context.

// No verified exploit code published in NVD references.
// See linked PoC repository for technical details.

Detection Methods for CVE-2026-7591

Indicators of Compromise

• MCP tool invocations containing SQL metacharacters such as single quotes, semicolons, --, /*, or UNION in request.params.arguments fields
• Unusual database error messages logged by the astro-mcp-server process
• Unexpected outbound database queries originating from the MCP server during tool calls

Detection Strategies

• Inspect MCP request payloads at the application layer and flag arguments containing SQL syntax tokens
• Enable verbose query logging on the backend database and correlate query patterns with MCP tool invocations
• Review GitHub deployment logs for the astro-mcp-server process for stack traces referencing SQL parser errors

Monitoring Recommendations

• Alert on database queries that contain concatenated string literals derived from MCP request fields
• Monitor authentication logs for low-privileged accounts issuing high volumes of tool calls
• Track outbound traffic from MCP servers for data volumes inconsistent with normal tool usage

How to Mitigate CVE-2026-7591

Immediate Actions Required

• Restrict network access to astro-mcp-server instances so only trusted clients can reach the MCP endpoint
• Audit which database accounts the MCP server uses and reduce their privileges to the minimum required
• Review historical logs for evidence of SQL injection attempts in request.params.arguments

Patch Information

No official patch has been released. According to the CVE record, the project maintainers were notified through a GitHub Issue Tracker report but have not responded. Monitor the GitHub PoC Repository for upstream fixes.

Workarounds

• Deploy the MCP server behind an authenticating reverse proxy that filters payloads containing SQL metacharacters
• Replace dynamic SQL construction in src/index.ts with parameterized queries or a query builder that escapes input
• Run the MCP server's database user with read-only permissions where the use case allows
• Consider forking the project to apply input validation until upstream guidance is available

# Example: restrict astro-mcp-server to localhost via firewall until patched
sudo iptables -A INPUT -p tcp --dport 3000 ! -s 127.0.0.1 -j DROP