AI agent vulnerability · Other MCP servers and tools

CVE-2026-11529: MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler

lowCVSS 4.0 2.1 · 3.1 6.3GHSA-mvq4-39wx-6h5g

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Published Jun 8, 2026 · Updated Jul 24, 2026

Affected packages

mysql-mcp-server

Ecosystem: PyPI
Affected: < 0.3.0
Fixed in: 0.3.0
Check: pip show mysql-mcp-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.

Credited to faketut.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries