CVE-2026-85788CWE-184

CVE-2026-85788

Medium · published September 9, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whitespace.

To remediate this issue, users should upgrade to version 1.0.23.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
5.7 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-09-09T21:17Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-103-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/awslabs/mcp/releases?page=2#release-2026.07.20260702161703 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/awslabs/mcp/security/advisories/GHSA-x25m-ph3m-3r9q · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 16:24Z
    Incomplete list of disallowed inputs in awslabs mysql-mcp-server
    cvelistv5