Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-48774 – SQL Write Bypass via MCP Multi-Statement Injection – ProxySQL 3.0.0–3.0.8

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-48774 is a high-severity improper input validation vulnerability (CVSS 7.5) in ProxySQL versions 3.0.0 through 3.0.8. The GenAI/MCP run_sql_readonly tool fails to enforce its documented read-only contract on MySQL targets, allowing an unauthenticated remote attacker to execute arbitrary write or administrative SQL statements against the backend database by injecting a second statement into the payload. A fix is available in ProxySQL version 3.0.9.

Technical details

  • Root cause: The run_sql_readonly tool validates SQL input using only a first-keyword allowlist (e.g., must start with SELECT) and a substring blacklist. However, backend connections are established with the CLIENT_MULTI_STATEMENTS flag enabled, which permits multiple semicolon-separated SQL statements to be executed in a single call. The blacklist does not cover common side-effecting statements such as RENAME TABLE, SET, RESET, LOCK TABLES, and KILL.
  • Trigger condition: Any caller that can reach the /mcp/query HTTP endpoint and send a run_sql_readonly tool call with a multi-statement payload. By default, mcp-query_endpoint_auth is empty, meaning no authentication token is required in the default configuration.
  • Attack vector: Network-accessible HTTP endpoint (/mcp/query, default port 6071, JSON-RPC 2.0). The endpoint is reachable without credentials in the default state. An example payload — SELECT 1; RENAME TABLE testdb.table TO testdb.table_renamed — is accepted by the validator because the string starts with SELECT and RENAME TABLE is absent from the blacklist.
  • Impact: The read-only security contract is violated. An attacker can perform unauthorized write or administrative operations (table renames, SET, RESET, LOCK TABLES, KILL) against the backend MySQL database, limited only by the database privileges of the configured MCP target account. A successful live exploitation was confirmed in the advisory: the MCP response reported success for the SELECT while direct backend verification confirmed the table had been renamed. The CVSS Integrity impact is rated High (I:H). A secondary impact is connection pool poisoning ("Commands out of sync" state).

Affected software

  • ProxySQL versions 3.0.0 through 3.0.8 (inclusive)

Severity

  • CVSS v3.1 base score: 7.5 (HIGH)
  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Mitigation and recommended actions

  • Immediate — upgrade: Update ProxySQL to version 3.0.9, which contains the vendor-provided fix. Version 3.0.9 was released on June 5, 2026.
  • If immediate patching is not possible — operator-level workarounds:
    • Set a non-empty mcp-query_endpoint_auth bearer token before exposing /mcp/query to any network: SET mcp-query_endpoint_auth='<strong-token>';
    • Disable the MCP server entirely if not in active use: SET mcp-enabled=false;
    • Restrict the MCP listener’s network exposure so that /mcp/query is not reachable from untrusted networks or the internet.
    • Configure the MCP backend target account as a database-level read-only user to limit the blast radius if exploitation occurs.
    • Add temporary MCP query rules to block payloads containing semicolons or other obvious multi-statement patterns.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge