# DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

DBHub HTTP MCP mode validated Origin against Host by equality only, so DNS rebinding let a malicious page run unauthenticated execute_sql against the victim's database.

- Payout: Research
- Severity: critical
- Program: DBHub
- Found by: junbyjun1238, avishaigonen-pluto
- Disclosed: 2026-09-24
- CVE: CVE-2026-61742
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-fm8p-53ww-hf6w
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-fm8p-53ww-hf6w
- Tags: area:ai domain:ai domain:web impact:data-leak impact:integrity kind:research platform:ghsa sev:critical tech:nodejs technique:source-review vuln:access-control vuln:auth-bypass vuln:cors

**Target:** HTTP MCP endpoint /mcp (JSON-RPC execute_sql tool)
**Root cause:** Origin/Host protection compares hostnames for equality instead of checking membership in an explicit allowed-hosts/allowed-origins policy, and /mcp requires no auth token or CSRF capability. After rebinding, both Origin and Host carry the attacker hostname, so the check passes.
**Steps:**
1. Start DBHub in HTTP mode: `npx -y @bytebase/dbhub@0.21.2 --transport http --port <port> --demo`
2. Control request with `Host: localhost:<port>` and `Origin: http://attacker.example` returns 403
3. Rebinding-shaped request with `Host: dbhub-rebind.example:<port>` and `Origin: http://dbhub-rebind.example` returns 200 and reflects `Access-Control-Allow-Origin: http://dbhub-rebind.example`
4. POST JSON-RPC `tools/list` to `/mcp` with those headers to enumerate tools
5. POST `tools/call` with `{"name":"execute_sql","arguments":{"sql":"select 'STANDALONE_REBIND_CANARY' as proof"}}` and read result
6. POST `execute_sql` with `create table if not exists dns_rebind_probe(...); insert ...; select count(*) as rows_written` to confirm writes
**How found:** Code review of src/server.ts middleware: noticed the Origin check only asserts originHost === host, which is trivially satisfiable under DNS rebinding since both headers derive from the attacker-controlled hostname; confirmed with a standalone PoC sending rebinding-shaped headers.
**Exploitation:** Victim visits attacker page at http://dbhub-rebind.example:8080; attacker DNS initially resolves to attacker server serving JS, then rebinds to victim-reachable DBHub on same port. Browser then sends same-origin requests to /mcp with attacker hostname in both Host and Origin; DBHub accepts, reflects the origin with credentials, and the page reads JSON-RPC responses, exfiltrating query results over normal browser egress.
**Escalation:** Read-only demo DB escalates to full read/enumerate/write of a real configured database when execute_sql is not read-only and credentials are privileged.
**Insight:** Any anti-CSRF/rebinding check that compares Origin to Host by equality is void under rebinding — both are attacker-controlled. Look for equality-based origin checks in localhost-bound dev servers and MCP/agent HTTP transports, and test with a Host/Origin pair of an arbitrary attacker domain.

## Proof of concept (copied exactly from the original report)

**Rebinding request shape accepted by server**

```
Host: dbhub-rebind.example:8080
Origin: http://dbhub-rebind.example
```

**Blocked cross-origin control request**

```
Host: localhost:8080
Origin: http://attacker.example
```