Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whitespace. To remediate this issue, users should upgrade to version 1.0.23.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-85788 Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-… https://www.cve.org/CVERecord?id=CVE-2026-85788
Post summary
The post briefly references CVE‑2026‑85788, describing an input validation flaw in Amazon's mysql‑mcp‑server and linking to the CVE record.
AWS flags CVE-2026-85788 in awslabs.mysql-mcp-server (<=1.0.21, Important): SQL inline comments can bypass the package read-only check on self-hosted MySQL MCP. Not an AWS-managed service impact; upgrade to 1.0.23+ and keep DB creds least-privilege.
Post summary
AWS has disclosed CVE-2026-85788, a SQL inline‑comment bypass affecting awslabs.mysql‑mcp‑server v1.0.21 and earlier, recommending users upgrade to 1.0.23+ and use least‑privilege DB credentials.