CVE-2026-85788
Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whitespace. To remediate this issue, users should upgrade to version 1.0.23.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.7
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CWE
- CWE-184
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- AWS AWS Labs MySQL MCP Server
Weakness type
Related vulnerabilities
- CVE-2026-87911 — Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
- CVE-2026-86199 — PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
- CVE-2026-79696 — Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
- CVE-2026-82536 — Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
- CVE-2026-69624 — Active Directory Certificate Services (AD CS) Tampering Vulnerability
- CVE-2026-70334 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-33197 — BDS Module Bypass Secure Boot Advisory
- CVE-2026-85787 — An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server