Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration
Alibaba's RDS MCP server hands out database schema information, connection strings, and credential metadata to anyone who asks, without checking who is asking. Alibaba has acknowledged this but will not fix it, so any deployment using this server is permanently exposed.
How the attack works
An attacker locates or is given access to an Alibaba RDS MCP server endpoint. They send MCP tool calls that request database metadata functions without providing any authentication. The server responds with database schema structures, connection strings, and credential-related metadata. With this information the attacker can enumerate what databases exist and potentially obtain credentials needed to connect to them directly.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d1824afa-b2df-4e29-917c-2d65702a708f
- Severity
- High
Why it matters
An organization using this MCP server can have its database structure and connection credentials read by anyone who can reach the endpoint, exposing a path to direct database compromise without needing to breach any authentication first.
What you can do
- →Do not expose the Alibaba RDS MCP server endpoint to untrusted networks; restrict access to an authenticated VPN or private network only.
- →Audit any MCP configurations that point to Alibaba RDS endpoints and confirm they require authentication at the network or application layer.
- →Rotate any database credentials that may have been reachable through this metadata surface.
- →Monitor for tool calls to RDS metadata functions that lack authentication context, and treat unexpected enumeration of database schemas as suspicious.
Known benign look-alikes
- Internal Alibaba RDS deployments behind authenticated VPN.
- Security scanning tooling probing the Alibaba RDS MCP endpoint.
- Educational content describing the vulnerability.