CVE-2026-11529

MEDIUM

designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-369146 | designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection
https://vuldb.com/vuln/369146
Signature, Permissions Required signature permissions-required
VDB-369146 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/369146/cti
Third Party Advisory third-party-advisory
CVE-2026-11529 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-11529
Third Party Advisory third-party-advisory
Submit #836490 | designcomputer mysql_mcp_server 0.2.2 SQL Injection
https://vuldb.com/submit/836490

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 10.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (4)
designcomputer/mysql-mcp-server 0.2.0
designcomputer/mysql-mcp-server 0.2.1
designcomputer/mysql-mcp-server 0.2.2
designcomputer/mysql-mcp-server 0.3.0
Published Jun 08, 2026
Tracked Since Jun 08, 2026