CVE-2026-48774 ProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract
ProxySQL's MCP read-only tool allows side-effecting SQL via multi-statements, enabling unauthorized database modifications if MCP is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48774?
CVE-2026-48774 is a high-severity vulnerability in sysown proxysql, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP `run_sql_readonly` tool violates its documented read-only contract for MySQL targets. The tool validates only the full input string with a substring blacklist and first-keyword allowlist, but then executes the entire SQL string on a backend connection created with `CLIENT_MULTI_STATEMENTS`. As a result, a caller can submit a read-only first statement followed by a side-effecting second statement, such as `SELECT 1; RENAME TABLE ...`. The validator accepts the payload because it starts with `SELECT` and because side-effecting MySQL statements such as `RENAME TABLE`, `SET`, `RESET`, `LOCK TABLES`, and `KILL` are not rejected by the blacklist. In a live MCP runtime test, the `/mcp/query` endpoint accepted a `run_sql_readonly` request. The MCP response reported success for the first `SELECT`, and direct backend verification showed that the table had actually been renamed. This violates the endpoint's read-only security contract and lets an MCP caller perform backend writes or administrative SQL, limited by the configured MCP target account's database privileges. Version 3.0.9 contains a fix. Other operator mitigations include: keeping MCP disabled unless required; setting a non-empty `mcp-query_endpoint_auth` token before exposing `/mcp/query`; restricting MCP listener network exposure; configuring MCP backend target credentials as database-level read-only users; and adding temporary MCP query rules to block obvious multi-statement patterns.
Weakness: CWE-20
Which versions are affected by CVE-2026-48774?
1 open source package ship an affected version, including proxysql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
proxysql Bitnami | From 3.0.6 | 3.0.9 |
Products include Proxysql Proxysql.
How do I fix CVE-2026-48774?
Upgrade proxysql to 3.0.9 or later.
Is CVE-2026-48774 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48774 exists.
Other vulnerabilities in sysown proxysql
Sources
Also known as BIT-proxysql-2026-48774, GHSA-7wh6-2vcc-gcm4.