CVE-2026-85788

Executive Summary

CVE-2026-85788 is an input-validation bypass (CWE-184, Incomplete List of Disallowed Inputs) in the mutable SQL detector component of Amazon's awslabs mysql-mcp-server, a Model Context Protocol (MCP) server that exposes MySQL database operations to LLM-driven agents. The detector's regex engine fails to treat SQL inline comments as whitespace, so a crafted query can slip past the read-only enforcement gate and reach file-read and file-write SQL sinks. The impact is high confidentiality loss (C:H) with no integrity or availability impact per the CVSS vector; the issue is scored 5.5. All deployments of mysql-mcp-server below version 1.0.23 are affected.

Technical Analysis

The vulnerability lives in a defense-in-depth control rather than in MySQL itself. The awslabs mysql-mcp-server is an MCP server that brokers natural-language-driven SQL execution for autonomous or semi-autonomous agents. Because an LLM can be steered by untrusted content (prompt injection from tool output, retrieved documents, or user input), the server implements a "read-only enforcement gate" — a guard intended to reject statements that reach file-read or file-write sinks before they are sent to the database.

That gate is implemented, per the NVD description, as a "mutable SQL detector component" backed by a regex engine. Regex-based SQL classification is inherently fragile: the tokenizer and the database parser rarely agree on what constitutes whitespace, comments, or statement boundaries. Here, the specific gap is that the detector "does not treat [SQL inline comments] as whitespace." In MySQL, inline comments can function as whitespace between tokens — for example a comment placed between keywords, operators, or identifiers. A detector that models only literal spaces, tabs, and newlines as separators will fail to recognize a keyword when a comment is inserted adjacent to it, or will fail to normalize a statement containing comment-interleaved tokens.

The result is a context-dependent bypass. The description states "context-dependent actors" can bypass the gate — i.e., the exploitation is contingent on who can supply SQL to the server (a direct user, or an LLM that has absorbed attacker-controlled input). When the malformed-but-valid query reaches MySQL, the read-only gate does not block it, and the file-read and file-write SQL sinks are reached. CWE-184 is the appropriate classification: the disallowed-input list (and the comment-as-whitespace handling within it) is incomplete, so inputs outside the list bypass the control.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N is consistent with this framing: local attack path (AV:L) — the attacker must interact with the MCP server/host rather than a remote network endpoint; low complexity; no privileges required; user interaction required (UI:R) — a human or agent must cause the crafted statement to be processed; scope unchanged; high confidentiality impact only; no integrity or availability effect as scored.

Notably, the description says the bypass reaches both file-read and file-write sinks, yet the CVSS vector scores integrity at N. Section 4 explains this tension.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker identifies a host or service exposing awslabs mysql-mcp-server (e.g., via Shodan using the dorks above) and determines that the MCP server is version < 1.0.23.

2. Triggering the flaw class. The attacker supplies a SQL statement that combines (a) a legitimate-looking read operation with (b) a file-read or file-write SQL sink, and inserts SQL inline comments between tokens so the regex-based read-only detector mis-parses the statement — specifically because the detector does not treat inline comments as whitespace and therefore fails to normalize / correctly classify the input. The comment placement, not the sink itself, is what defeats the gate.

3. Execution method. The crafted statement is submitted through whichever input path the MCP server exposes to its client/agent (natural-language request, tool invocation, or prompt-injected content that drives the agent). Because the read-only enforcement gate is bypassed, the statement is not filtered and is forwarded to MySQL, where it reaches the file-read / file-write sinks the gate was meant to protect. Public PoC status: none. Do not assume a specific URL, function name, or parameter name — none is disclosed in the NVD description.

4. Post-exploitation impact. Successful exploitation yields the confidentiality impact the vector describes: an attacker (or a compromised/steered LLM agent) can read files the MySQL server process can access, and can invoke file-write sinks. The UI:R component reflects that the crafted query must be delivered through an interaction path tied to the MCP server, not fired blindly at a public web endpoint.

Impact Assessment

• Confidentiality — High (C:H): file-read sinks are reachable, exposing data the MySQL server can read.
• Integrity — None (I:N): despite the description naming file-write sinks, the provided CVSS vector scores integrity as None. Treat the write path as a latent risk: the stated vector and the named sinks are contradictory in emphasis, and the conservative reading (write impact not reflected in the score) should drive hardening priorities, not the reverse.
• Availability — None (A:N): no availability impact in the vector.
• Attack vector — Local (AV:L) / No privileges (PR:N) / User interaction (UI:R): blast radius is bounded to environments where an MCP server is reachable by the attacker and where a query can be processed.
• Affected systems: every deployment of awslabs mysql-mcp-server below 1.0.23. These are typically agent/automation environments with elevated database access — a high-value target precisely because the server is intended to bridge an LLM into a database.

Detection Guidance

Rule caveat: because no public PoC, exact query string, or sink identifier is disclosed, the following rules are generic heuristics targeting comment-interleaved SQL reaching MySQL through an MCP server. They will produce false positives and should be tuned to the local environment.

Sigma Rule

title: Suspicious Comment-Interleaved SQL via mysql-mcp-server
id: 7f2b9c1a-4d3e-4a5f-9b8c-1a2b3c4d5e6f
status: experimental
description: Detects SQL statements containing inline comments between tokens reaching a MySQL MCP server context - a heuristic indicator for CVE-2026-85788 (read-only gate bypass via comment-as-whitespace).
author: valtersit.com
date: 2026-01-01
logsource:
    product: linux
    category: process_creation
detection:
    selection_mcp:
        CommandLine|contains:
            - 'mysql-mcp-server'
            - 'mysql_mcp'
    selection_comment_sql:
        CommandLine|re: '(?i)/\*.*\*/\s*(SELECT|UNION|INTO\s+OUTFILE|INTO\s+DUMPFILE|LOAD_FILE|LOAD\s+DATA)'
    condition: selection_mcp and selection_comment_sql
falsepositives:
    - Legitimate application SQL that uses inline comments for hints (e.g. /*+ ... */)
level: medium
tags:
    - attack.t1190
    - cve.2026.85788

YARA Rule

rule CVE_2026_85788_Comment_SQL_Bypass
{
    meta:
        description = "Heuristic: comment-interleaved SQL used to bypass regex read-only gate in awslabs mysql-mcp-server (CVE-2026-85788)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85788"
        severity = "medium"

    strings:
        $srv  = "mysql-mcp-server" ascii wide nocase
        $srv2 = "mysql_mcp" ascii wide nocase
        $sql1 = /\/\*[^\*]*\*\/[ \t]*SELECT/ nocase
        $sql2 = /LOAD_FILE[ \t]*\(/ nocase
        $sql3 = /INTO[ \t]+(OUTFILE|DUMPFILE)/ nocase
        $sql4 = /UNION[ \t]*\/\*[^\*]*\*\/[ \t]*SELECT/ nocase

    condition:
        ($srv or $srv2) and any of ($sql*)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-85788 Possible mysql-mcp-server Read-Only Gate Bypass via Comment-Interleaved SQL"; flow:to_server,established; content:"/*"; content:"*/"; content:"SELECT"; nocase; pcre:"/\/\*[^\*]*\*\/[\s]*SELECT/i"; content:"LOAD_FILE"; nocase; content:"INTO OUTFILE"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-user; sid:202685788; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [process where process.name : "mysql-mcp-server*" and process.args : "*/*" and process.args : "*SELECT*"]
  [network where destination.port == 3306]

Splunk SPL Query

index=* (CommandLine="*mysql-mcp-server*" OR process="*mysql-mcp-server*")
| regex CommandLine="(?i)/\*.*\*/.*(SELECT|UNION|LOAD_FILE|INTO\s+(OUTFILE|DUMPFILE))"
| stats count values(CommandLine) as cmds by host, user, sourcetype
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-85788,mysql,mcp,">
  <rule id="100788" level="10">
    <decoded_as>json</decoded_as>
    <field name="CommandLine">mysql-mcp-server</field>
    <field name="CommandLine">\/\*.*\*\/.*SELECT</field>
    <description>CVE-2026-85788: Possible read-only gate bypass in awslabs mysql-mcp-server - comment-interleaved SQL reaches MySQL sink</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was returned. The vendor-stated remediation is to upgrade to 1.0.23.

1. Immediate mitigations

   • Treat awslabs mysql-mcp-server as an untrusted-input boundary: do not expose it to LLM agents that can be influenced by untrusted documents, tool output, or users.
   • Run the MCP server under a database account with the minimum privileges (no FILE privilege; revoke LOAD_FILE/SELECT ... INTO OUTFILE/INTO DUMPFILE capability). Stripping the FILE privilege removes the file-read/write sinks regardless of whether the regex gate is bypassed.
   • Apply an allow-list proxy in front of MySQL that enforces read-only semantics from outside the regex detector (e.g., a statement-level policy that rejects any statement that is not a plain SELECT after full parsing).

2. Patch / upgrade steps

   • Upgrade awslabs mysql-mcp-server to 1.0.23 or later as an emergency change.
   • After upgrade, re-verify the read-only gate against comment-interleaved statements in a non-production environment before trusting the fix.

3. Long-term hardening

   • Replace regex-based SQL classification with a SQL parser that produces a canonical AST; classify statements from the AST, not from the raw string.
   • Add comment-stripping / normalization as an explicit, tested step in the gate, with unit tests covering inline comments between every keyword and within each sink pattern.
   • Keep the MCP server and its database account privileges in separate trust boundaries so a detector bypass does not grant file-read/write.
   • Monitor and alert on the detection heuristics above; feed results back to tune the detector.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85788
• MITRE CWE-184 (Incomplete List of Disallowed Inputs): https://cwe.mitre.org/data/definitions/184.html
• Project repository: https://github.com/awslabs/mysql-mcp-server (returned 404 — verify manually)
• FIRST EPSS (not yet scored): https://www.first.org/epss/
• CISA KEV catalog (no entry — CVE-2026-85788 is NOT in KEV): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / campaign evidence: None available. No public PoC, no exploit code, no Nuclei template, and no CISA KEV entry were identified. This report reflects pre-PoC analysis only.