GHSA-j656-3hf2-fvjc: DBHub read-only mode bypass on MySQL and MariaDB

The GitHub-reviewed advisory says that in DBHub the read-only mode can be bypassed on the MySQL and MariaDB connectors, so a caller can still execute write and data definition language (DDL) statements such as DROP TABLE, which defeats the protection read-only mode is meant to provide when a database is exposed to an artificial intelligence (AI) agent; fixed in 0.22.6.

The record

Kind

Vulnerability

Source record

GHSA-j656-3hf2-fvjc: @bytebase/dbhub: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation (GitHub-reviewed advisory via OSV)

Record published

2026-11-02

Posted here

2026-11-03

World

Software agents · Enterprise work agents

Controls concerned

Destructive-action gate C-E3; Authority binding C-A2

Checked

Checked against its record on 2026-11-03 by a reader who did not draft it; report verification/reports/SIG-2026-11-03-002-2026-11-03.md.

A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.

Corrections

Changes to what this signal says, with the reason. Every earlier version is kept.

• 2026-11-03: Summary. Plain-language rule: abbreviations DDL and AI spelled out at first use; fixed version added as the osv.dev record states it (@bytebase/dbhub fixed 0.22.6). Found by the independent reader of 3 November 2026.
  Show the change

  Before: The GitHub-reviewed advisory says that in DBHub the read-only mode can be bypassed on the MySQL and MariaDB connectors, so a caller can still execute write and DDL statements such as DROP TABLE, which defeats the protection read-only mode is meant to provide when a database is exposed to an AI agent.

  After: The GitHub-reviewed advisory says that in DBHub the read-only mode can be bypassed on the MySQL and MariaDB connectors, so a caller can still execute write and data definition language (DDL) statements such as DROP TABLE, which defeats the protection read-only mode is meant to provide when a database is exposed to an artificial intelligence (AI) agent; fixed in 0.22.6.

What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.

Newer: CVE-2026-116635: AWS Serverless MCP Server path traversal in deployment status
Older: CVE-2026-120338: Prefab UI's Generative UI sandbox for untrusted code, including code written by a large language model, let that code read and write files on the server