MySQL MCP Server Unauthenticated SQL Exploitation via SSE Transport

How the attack works

An attacker sends HTTP requests to the server's /sse endpoint and calls the execute_sql tool. Because Origin/Host validation is missing, DNS-rebinding protections that would normally block a browser-based attacker are absent, so requests can come from an unauthenticated remote client or from a victim's browser redirected via a rebinding attack. The payload contains recognizable malicious SQL patterns: UNION-based injection, file-privilege abuse (INTO OUTFILE/DUMPFILE, LOAD_FILE, LOAD DATA INFILE), enumeration of mysql.user, or time-based blind injection probes like SLEEP/BENCHMARK. If successful, the attacker can read or write files on the database host, dump credentials, or extract arbitrary data via blind injection.

Netzilo detection

Why it matters

An organization can lose confidentiality of database contents and potentially host files, and lose control over database accounts if mysql.user is harvested, all without the attacker needing valid credentials.

What you can do

• →Restrict network access to the MySQL MCP Server's SSE/HTTP endpoint to trusted hosts only; do not expose it directly to the internet.
• →Enforce Origin and Host header validation at a reverse proxy in front of the server if the server itself does not support it.
• →Review the database account used by execute_sql and remove FILE privilege and unnecessary access to mysql.user unless explicitly required.
• →Monitor execute_sql calls for UNION SELECT, OUTFILE/DUMPFILE, LOAD_FILE, mysql.user queries, and SLEEP/BENCHMARK patterns, and treat unexpected occurrences as suspicious.

Known benign look-alikes

• Internal reporting or BI tooling that legitimately issues UNION SELECT queries for combined result sets directly against the exposed execute_sql tool over SSE transport.
• Database performance diagnostics that intentionally call SLEEP() or BENCHMARK() while load-testing a database exposed through the MCP server.
• Database administration tooling that queries mysql.user via the execute_sql tool for legitimate account auditing.
• Any of the above still warrants human security review, since they are reaching the database through an unauthenticated SSE transport path.

References

• https://owasp.org/Top10/A01_2021-Broken_Access_Control/
• https://owasp.org/Top10/A03_2021-Injection/
• https://en.wikipedia.org/wiki/DNS_rebinding

Related threats