Bulletin ID: 2026-103-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/09/2026 09:15 PM PDT

Description:

We identified an issue in awslabs.mysql-mcp-server (an open-source, self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI). In affected versions, under certain conditions the read-only enforcement could be circumvented via SQL inline comments, allowing a statement to run that the read-only check was expected to block. The read-only mode provided by the server is a best-effort safeguard and is not a substitute for correctly scoped database permissions; the effective boundary is the permissions of the configured MySQL user.

This issue does not affect the confidentiality or integrity of any AWS service. awslabs.mysql-mcp-server is a client-side, self-managed package; customers control installation and the privileges of the database credentials they configure.

Affected versions: awslabs.mysql-mcp-server ≤ 1.0.21

Resolution:

The issue is addressed in awslabs.mysql-mcp-server 1.0.23. We recommend customers upgrade to 1.0.23 or later:

    pip install --upgrade awslabs.mysql-mcp-server

As defense in depth, ensure the database user configured for the MCP server is granted only the minimum privileges required, and does not hold the FILE privilege unless explicitly needed.

Workarounds:

None.

References:

• CVE-2026-85788
• GHSA-x25m-ph3m-3r9q

Acknowledgement:

We would like to thank Jaeyoung Yun for reporting this issue and working with us as part of our coordinated disclosure process.

Please email aws-security@amazon.com with any security questions or concerns.