CVE-2026-61742
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080.
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v4.0)
- EPSS
- 0.2% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- @bytebase/dbhub (npm) <= 0.22.4, fixed in 0.22.5 · GHSA-fm8p-53ww-hf6w