Am I affected by DBHub HTTP mode lets a malicious website run database commands through the victim's…? What should I do?

Question

DBHub started in HTTP transport mode (for example `--transport http --port 8080`) accepts MCP tool calls without any login token.

Affected: @bytebase/dbhub <= 0.22.4. Fixed in: 0.22.5. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-61742-bytebase-dbhub-dbhub

AgentArmor team · Accepted Answer

**Am I affected?**
Affected: @bytebase/dbhub <= 0.22.4. Fixed in: 0.22.5.
- Check your version: run `npm ls @bytebase/dbhub`. Versions <= 0.22.4 of @bytebase/dbhub are affected.

**What to do now**
1. Upgrade to the fixed version: run `npm install @bytebase/dbhub@0.22.5` (first patched version 0.22.5).
2. Bind HTTP transport to `127.0.0.1` instead of exposing it on other hosts.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- GitHub Advisory Database: https://github.com/advisories/GHSA-fm8p-53ww-hf6w

Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-61742-bytebase-dbhub-dbhub

Am I affected by DBHub HTTP mode lets a malicious website run database commands through the victim's…? What should I do?

1 answer

Add your answer or comment