DBHub’s read‑only mode was incorrectly implemented before version 0.22.6. The configuration flag that should enable PostgreSQL’s default_transaction_read the service to rely on a simple keyword classifier. With a regular database role this allows tampering with sequences, while a privileged role enables arbitrary file writes via lo_export, arbitrary file reads via pg_read_file, and remote code execution through dblink combined with COPY … TO PROGRAM. The CVSS score of 7.4 reflects the severity of these mitigations. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog.

Bytebase DBHub prior to version 0.22.6 on any of its supported databases—Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite—faces this issue. The component exposes an unauthenticated HTTP transport bound to 0.0.0.0, making the /mcp endpoint reachable by any network caller.

Because the endpoint is unauthenticated and listens on all interfaces, an attacker can submit malicious SQL via /mcp from any connected network. With a standard role, the attacker can compromise sequence integrity; with elevated privileges, the attacker can write arbitrary files to the server, read host files, and gain remote code execution. The CVSS score of 7.4 indicates a high risk, while the lack of EPSS data suggests moderate probability of exploitation based on current evidence. The absence from KEV further indicates no known widespread exploitation, but existing impact potential warrants immediate action.