CVE-2026-48774

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48774
Aliases
Published
2026-06-19T19:34:39Z
Modified
2026-10-28T10:55:33Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
ProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract
Details

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP run_sql_readonly tool violates its documented read-only contract for MySQL targets. The tool validates only the full input string with a substring blacklist and first-keyword allowlist, but then executes the entire SQL string on a backend connection created with CLIENT_MULTI_STATEMENTS. As a result, a caller can submit a read-only first statement followed by a side-effecting second statement, such as SELECT 1; RENAME TABLE .... The validator accepts the payload because it starts with SELECT and because side-effecting MySQL statements such as RENAME TABLE, SET, RESET, LOCK TABLES, and KILL are not rejected by the blacklist. In a live MCP runtime test, the /mcp/query endpoint accepted a run_sql_readonly request. The MCP response reported success for the first SELECT, and direct backend verification showed that the table had actually been renamed. This violates the endpoint's read-only security contract and lets an MCP caller perform backend writes or administrative SQL, limited by the configured MCP target account's database privileges. Version 3.0.9 contains a fix. Other operator mitigations include: keeping MCP disabled unless required; setting a non-empty mcp-query_endpoint_auth token before exposing /mcp/query; restricting MCP listener network exposure; configuring MCP backend target credentials as database-level read-only users; and adding temporary MCP query rules to block obvious multi-statement patterns.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48774.json"
}
References

Affected packages

Git / github.com/sysown/proxysql

Affected ranges

Type
GIT
Repo
https://github.com/sysown/proxysql
Events
Introduced
3803f11077f21510b2b43ea7168abf91b54b739e
Fixed
7ddb3dc015d1440e8a0fb0bbafa2df9aaaa2669d
Fixed
e32b7fd50c7c234ea628e392e621e09a2a919e08
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.0.6"
                },
                {
                    "fixed": "3.0.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "e32b7fd50c7c234ea628e392e621e09a2a919e08"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0.8
3.0.9
v3.*
v3.0.6
v3.0.7
v3.0.8
v3.1.6
v3.1.7
v3.1.8
v4.*
v4.0.6
v4.0.7
v4.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48774.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "14677646852975338150919769700734924794",
            "length": 602
        },
        "id": "CVE-2026-48774-0979df0e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sysown/proxysql/commit/e32b7fd50c7c234ea628e392e621e09a2a919e08",
        "target": {
            "file": "plugins/genai/src/tool_handlers/MySQL_Tool_Handler.cpp",
            "function": "MySQL_Tool_Handler::validate_readonly_query"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "236459869353234689226361392749896710520",
            "length": 1874
        },
        "id": "CVE-2026-48774-1035eded",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sysown/proxysql/commit/e32b7fd50c7c234ea628e392e621e09a2a919e08",
        "target": {
            "file": "plugins/genai/src/tool_handlers/MySQL_Tool_Handler.cpp",
            "function": "MySQL_Tool_Handler::init_connection_pool"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "284731519010912484305672175267416024725",
            "length": 425
        },
        "id": "CVE-2026-48774-30c3c7f4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sysown/proxysql/commit/e32b7fd50c7c234ea628e392e621e09a2a919e08",
        "target": {
            "file": "plugins/genai/src/tool_handlers/MySQL_Tool_Handler.cpp",
            "function": "MySQL_Tool_Handler::explain_sql"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "284179926813668346689974807632456835388",
                "244036860567082220923051200921357532219",
                "83917013513434989080908723931891483860"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48774-5dbfe43d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sysown/proxysql/commit/e32b7fd50c7c234ea628e392e621e09a2a919e08",
        "target": {
            "file": "plugins/genai/include/MySQL_Tool_Handler.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "92866459124518729291856770785785155338",
                "270612907586502527053231399616747107668",
                "236978870073924849467769078969649944696",
                "127705325167424275921351941214451823484",
                "104729916526657523687799699862260312982",
                "253026924709774835484618272481727671998",
                "145572969062612735424714055619531475994",
                "214275381784313485394240303049849991697",
                "46652093154855983880004383613344869361",
                "316843438052142673311827872417584069148",
                "59347037759587723721516233274828440933",
                "256388965347966411531741338988886878964",
                "321754246819572724438435347851063806657",
                "178437117692592209771995794769554020979",
                "237873271740869315187829288731257458226",
                "308291458346027466069881385021786477837",
                "295020176563478422969453288442677102106",
                "7179123992808749786632159068006985834",
                "338532279141838127184520456881969193842",
                "104832189363190220580520120183471247712",
                "225521395261247296404743640501779527337",
                "135915501130381548546060766020833746842",
                "38546026183513083225109192923329913893"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48774-da1b4c4c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sysown/proxysql/commit/e32b7fd50c7c234ea628e392e621e09a2a919e08",
        "target": {
            "file": "plugins/genai/src/tool_handlers/MySQL_Tool_Handler.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "299272894320096734731352456228767981911",
            "length": 620
        },
        "id": "CVE-2026-48774-e84b26f5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sysown/proxysql/commit/e32b7fd50c7c234ea628e392e621e09a2a919e08",
        "target": {
            "file": "plugins/genai/src/tool_handlers/MySQL_Tool_Handler.cpp",
            "function": "MySQL_Tool_Handler::is_dangerous_query"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:55:33Z"