Critical MySQL MCP Flaw and n8n's Five-CVE Week

Six advisories, two servers, one theme: the trust boundary you assumed was there often isn't. This week's disclosures hit a database connector and an automation platform that both sit on plenty of MCP-adjacent stacks — and one of them is critical.

CVE-2026-59971 — MySQL MCP Server: unauthenticated SQL execution (Critical)

Mysql_mcp_server builds its SseServerTransport without passing security_settings, which quietly disables the MCP Python SDK's built-in DNS-rebinding protection — the Origin/Host header validation that's supposed to stop a browser tab from talking to your local MCP server. On top of that, the Starlette app ships with no CORS or TrustedHost middleware, and it binds to 0.0.0.0 by default with no authentication on any route.

The trigger condition is specific: MCP_TRANSPORT=sse. The default stdio mode is unaffected. But if you flipped that env var to expose the server over HTTP — which is exactly what people do to share a MySQL MCP server across a team or a network — you've been running an open door to arbitrary SQL execution, either from a malicious webpage via DNS rebinding or from anyone who can simply reach the port directly.

What to do: if you're not using SSE mode, you're not affected — but confirm it. If you are, don't expose it beyond localhost until you've upgraded, and put it behind your own auth/reverse proxy in the meantime.

n8n's rough week: five advisories, all High

N8n picked up five separate High-severity CVEs in a single window, spanning sandbox escapes, an SSRF-style bypass, and a denial-of-service bug.

The two sandbox-escape bugs are the ones that matter most: both let an expression author — someone with workflow-editing access, not necessarily an admin — run arbitrary code in the n8n process or in another user's browser session. The domain-restriction bypass quietly undermines a credential-scoping control admins may be relying on. The ReDoS and storage-exhaustion bugs are lower-skill but still enough to take an instance down or fill its database.

What to do: n8n has already shipped fixes (1.123.76, 2.37.7, 2.38.2 cover at least the class-field sanitizer bug). Update to the latest patched release across the board rather than cherry-picking one fix — five advisories in one window means don't assume you're only exposed to the headline bug.

None of these are exotic. A missing security flag, a shared global anyone can override, a regex nobody load-tested. Patch both servers, and if you're running MySQL MCP over SSE, do it today.