CVE-2026-85788: Amazon awslabs mysql-mcp-server SQLI Vulnerability

CVE-2026-85788 Overview

CVE-2026-85788 is an authorization bypass vulnerability in the Amazon awslabs mysql-mcp-server component of the Model Context Protocol (MCP) server suite. The flaw resides in the mutable SQL detector, which enforces read-only query restrictions. The detector relies on a regex engine that fails to treat SQL inline comments as whitespace. Context-dependent attackers can craft SQL statements containing inline comments to evade the disallowed-input list and reach file-read and file-write SQL sinks. The vulnerability is tracked under [CWE-184: Incomplete List of Disallowed Inputs].

Critical Impact
Bypass of the read-only enforcement gate allows attackers to execute file-read and file-write SQL operations that should be blocked, exposing local filesystem contents to a compromised or malicious MCP client.

Affected Products

Amazon awslabs mysql-mcp-server (versions prior to 1.0.23)
awslabs/mcp repository components exposing MySQL access to MCP clients
Deployments integrating the mysql-mcp-server into LLM agent toolchains

Discovery Timeline

2026-09-09 - CVE-2026-85788 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-85788

Vulnerability Analysis

The awslabs mysql-mcp-server enforces a read-only mode by inspecting SQL statements against a list of disallowed mutating keywords before forwarding them to MySQL. The enforcement logic uses a regex engine to tokenize and match input against the deny list. The engine does not account for SQL inline comment syntax such as /* ... */, which MySQL itself treats as whitespace during parsing.

An attacker who controls or influences the SQL sent through an MCP client can insert inline comments between keywords. The comments split or obscure disallowed tokens, causing the detector to classify the statement as read-only. MySQL then parses and executes the statement normally, reaching file-read sinks such as LOAD_FILE() or file-write sinks such as SELECT ... INTO OUTFILE. This mismatch between validator parsing and database parsing is a classic parser differential.

Root Cause

The root cause is an incomplete list of disallowed inputs [CWE-184]. The regex-based detector does not normalize inline SQL comments prior to matching. Because the validator and MySQL disagree on token boundaries, the deny list can be bypassed while the target parser still executes the intended operation.

Attack Vector

Exploitation requires a local attack path and passive user interaction, consistent with an MCP client operator invoking a crafted tool call. The attacker submits SQL containing inline comments positioned to fragment mutating keywords or file-sink function names. The validator sees an apparently benign read-only query. MySQL executes the reconstructed statement, granting file-read or file-write access constrained only by the MySQL account privileges and secure_file_priv setting.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-x25m-ph3m-3r9q for vendor technical details.

Detection Methods for CVE-2026-85788

Indicators of Compromise

SQL statements sent through the MCP server containing inline /* ... */ comments embedded within or between keywords
MySQL general or audit log entries showing LOAD_FILE(), INTO OUTFILE, or INTO DUMPFILE operations originating from the MCP service account
Unexpected file creation in directories referenced by the MySQL secure_file_priv variable

Detection Strategies

Enable the MySQL general query log or audit plugin and alert on LOAD_FILE, OUTFILE, and DUMPFILE usage by the MCP database user
Inspect MCP server request logs for SQL payloads containing inline comment sequences, especially adjacent to DML or DDL keywords
Compare deployed awslabs mysql-mcp-server versions against 1.0.23 across managed hosts and container images

Monitoring Recommendations

Monitor filesystem paths writable by the MySQL process for new or modified files correlated with MCP client activity
Track outbound MCP tool invocations that return unusually large payloads consistent with file exfiltration
Alert on any privilege change or grant modification for the database account used by the MCP server

How to Mitigate CVE-2026-85788

Immediate Actions Required

Upgrade awslabs mysql-mcp-server to version 1.0.23 or later across all deployments
Revoke FILE privilege from the MySQL account used by the MCP server if it is not strictly required
Set the MySQL secure_file_priv variable to an empty value or a tightly scoped directory to block arbitrary file I/O

Patch Information

The issue is remediated in awslabs mysql-mcp-server version 1.0.23. Release details are available in the GitHub MCP Release 2026.07 notes and the AWS Security Bulletin 2026-103.

Workarounds

Restrict MCP server access to trusted clients and operators until patching is complete
Configure the backing MySQL account with least privilege, removing FILE, SUPER, and unnecessary DDL rights
Deploy a database proxy or query firewall that normalizes comments before applying deny-list checks

bash

# Configuration example
pip install --upgrade awslabs-mysql-mcp-server==1.0.23

# MySQL hardening for the MCP service account
mysql -u root -p -e "REVOKE FILE ON *.* FROM 'mcp_user'@'localhost';"
mysql -u root -p -e "SET GLOBAL secure_file_priv = '';"