CVE-2026-48774

Name of the Vulnerable Software and Affected Versions ProxySQL versions 3.0.0 through 3.0.8

Description The GenAI/MCP run sql readonly tool violates its read-only contract for MySQL targets. The tool validates input using a substring blacklist and a first-keyword allowlist, but executes the SQL string on a backend connection created with CLIENT MULTI STATEMENTS. This allows a caller to bypass restrictions by submitting a read-only first statement followed by a side-effecting second statement, such as SELECT 1; RENAME TABLE .... The validator accepts these payloads because they start with SELECT and certain side-effecting statements like RENAME TABLE, SET, RESET, LOCK TABLES, and KILL are not included in the blacklist. This issue was observed at the '/mcp/query' endpoint, enabling an MCP caller to perform backend writes or administrative SQL based on the target account's privileges.

Recommendations Update to version 3.0.9. Keep MCP disabled unless required. Set a non-empty mcp-query endpoint auth token before exposing '/mcp/query'. Restrict MCP listener network exposure. Configure MCP backend target credentials as database-level read-only users. Add temporary MCP query rules to block multi-statement patterns.