Am I affected by MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables…? What should I do?
In SSE mode, the server built its SSE transport without the security settings, so the SDK's protection against DNS rebinding was off.
Affected: mysql-mcp-server < 0.4.2. Fixed in: 0.4.2. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-59971-mysql-mcp-server (opens external site)
1 answer
Am I affected? Affected: mysql-mcp-server < 0.4.2. Fixed in: 0.4.2.
- Check your version: run
pip show mysql-mcp-server. Versions < 0.4.2 of mysql-mcp-server are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "mysql-mcp-server>=0.4.2"(first patched version 0.4.2). - Bind the service to 127.0.0.1, the documented recommended bind address.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-rqfv-2mw9-78g2 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-59971-mysql-mcp-server (opens external site)
Did this work for you?- Check your version: run