Loading story…
Researchers identified SQL injection and improper-access-control weaknesses in Model Context Protocol (MCP) database servers that label interfaces as read-only by checking only whether submitted SQL begins with SELECT. In PostgreSQL, SELECT can call functions with side effects or administrative privileges; where multi-statement queries are allowed, attackers may also append additional commands. CVE-2025-59333 affects ExecuteAutomation's @executeautomation/database-server npm package and is rated CVSS 8.1.
An authenticated low-privilege user able to submit MCP queries could modify data through stored functions, retrieve data beyond intended scope under the service account's permissions, terminate database backends, or trigger expensive queries for denial of service. Organizations should not rely on SQL prefix filtering: enforce read-only database roles and transactions, restrict connections to allowlisted tables and functions, require single statements, use parameterized queries, and apply least-privilege permissions to MCP service accounts.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
An improper-access-control vulnerability in ExecuteAutomation's MCP Database Server npm package (@executeautomation/database-server) allows queries based solely on whether they begin with SELECT. In PostgreSQL, an authenticated low-privilege attacker could invoke side-effecting functions to alter data, terminate database backends for denial of service, or access data permitted to the server's database account; the issue is rated CVSS 8.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
nodejs-security.com
Open sourcenodejs-security.com
Open sourcesecuritylabs.datadoghq.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A design flaw in the Python-based **Simple PSQL MCP Server** lets users bypass its purported read-only mode because the control accepts any input beginning with `SELECT`. In PostgreSQL, `SELECT` statements can invoke functions and query system views, allowing an attacker using sufficiently privileged database credentials to expose database activity and configuration data, terminate or disrupt backend connections, or cause denial-of-service conditions. The maintainer acknowledged the disclosure and noted that `simple-psql-mcp` is an educational starter template whose README warns of SQL-injection risk. Organizations deploying it should not treat keyword filtering as an authorization boundary: restrict the PostgreSQL role to least-privilege permissions and use an explicit allowlist of permitted queries or operations, rather than granting broadly privileged credentials to the MCP service.
Sep 3, 2026
Two newly disclosed vulnerabilities affected software built around the **Model Context Protocol (MCP)**, highlighting security weaknesses in AI-agent tooling. **CVE-2026-63119** impacts the MCP Ruby SDK distributed as the `mcp` gem before version `0.23.0`, where unbounded reads from stdio streams can let a connected peer or spawned subprocess send newline-free data until memory is exhausted, causing denial of service. Separately, **CVE-2026-54785** affects the `gemini-bridge` MCP server's file-handling logic, where improper path validation in `_resolve_path` allows directory traversal and local file disclosure outside the configured workspace, potentially exposing sensitive files through Gemini query responses. The disclosures come as MCP adoption expands and security guidance around AI-agent integrations matures. The MCP specification and introduction describe the protocol as a standard way to connect models with external tools and data sources, while recent security research has warned that tool-calling systems introduce risks including prompt injection, excessive privilege, SSRF, and data leakage. In parallel, the OpenID Foundation published draft **COAZ** and **COAZ-MCP** specifications to bring standardized authorization to MCP message flows before tool execution, and practitioner research on MCP deployments has emphasized authentication, input validation, logging, and least-privilege design as necessary safeguards for enterprise use.
Aug 1, 2026
Security researchers have identified significant vulnerabilities in implementations of the Model Context Protocol (MCP), a standard developed by Anthropic to facilitate secure and standardized connections between large language models (LLMs) and external data sources or tools. One notable vulnerability involved Burp's MCP server, which exposed a localhost port without proper web origin validation, enabling DNS rebinding attacks that could turn a user's Burp installation into a remote SSRF engine. This flaw allowed attackers to hijack Burp’s MCP tools and access internal networks, and was responsibly disclosed and rewarded with a $2,000 bounty. In addition, prompt hijacking attacks have been demonstrated against MCP-based AI workflows, particularly when session ID management is insecure. Researchers from JFrog discovered that the oatpp-mcp implementation generated predictable session IDs, making it susceptible to session hijacking and prompt injection attacks. These vulnerabilities highlight the risks associated with insecure MCP server configurations and underscore the need for robust validation, session management, and defensive controls when deploying MCP in security-sensitive environments.
Jul 23, 2026