DBHub
Token-efficient database MCP server for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.bytebase/dbhub
· Source code · Our trust grade: C
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| GHSA-j656-3hf2-fvjcDBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationAlso filed as CVE-2026-61789 | medium | Not flagged | Oct 30, 2026 |
| GHSA-fm8p-53ww-hf6wDBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionAlso filed as CVE-2026-61742 | critical | Not flagged | Sep 24, 2026 |
| GHSA-mwwr-p57h-56pf@bytebase/dbhub's read-only mode does not prevent database writesAlso filed as CVE-2026-61788 | high | Not flagged | Sep 24, 2026 |
Versions in the registry
1.6.0 (listed), 1.5.1, 1.5.0, 1.4.0, 1.3.1, 1.3.0, 1.2.5, 1.2.3, 1.2.2, 1.2.1, 1.2.0, 0.23.0, 0.22.4, 0.22.2, 0.21.1, 0.17.0, 0.13.2, 0.13.1