ProxySQL’s GenAI/MCP `run_sql_readonly` endpoint was designed to enforce a read‑only contract on MySQL targets, but in versions 3.0.0 through 3.0.8 the validator permits only a simple substring blacklist and a keyword allowlist. The backend connection used `CLIENT_MULTI_STATEMENTS`, so an attacker can submit a first statement that begins with a safe keyword such as SELECT, followed by a second, side‑effecting statement like RENAME TABLE, SET, or LOCK TABLES. The validation logic accepts the payload because the second statement is not covered by the blacklist, and the backend executes the entire string. Consequently, a caller who has permission to issue the MCP query can modify data or perform administrative actions on the database, breaching the promised read‑only interface.

The vulnerability affects systems running ProxySQL version 3.0.0 through 3.0.8. This includes deployments for MySQL, MariaDB and other MySQL‑compatible forks, and any service that exposes the `/mcp/query` endpoint to the network.

The CVSS score of 7.5 indicates a moderately high severity, and the absence of an EPSS score means the current public data does not quantify exploitation likelihood. The vulnerability is not listed in CISA KEV, suggesting no widely known exploits as of now. The likely attack vector is a compromised or exposed MCP endpoint; the attacker must have network access to `/mcp/query` and supply a valid query token. Because the backend connection uses the configured MCP target credentials, the extent of damage is bounded by those privileges, but an attacker can still perform any write or administrative operation within that account’s scope.