The designcomputer mysql_mcp_server is vulnerable to an unauthenticated remote code execution flaw when using the SSE transport protocol, posing a critical risk to database integrity and system security.

The application fails to perform authentication checks on critical API routes when the SSE transport is enabled, and it lacks protection against DNS rebinding. This allows an unauthenticated remote attacker to interact directly with database execution functions, enabling data exfiltration, modification, or, if the database user possesses FILE privileges, arbitrary system file access and code execution.

The vulnerability carries a CVSS score of 10.0, reflecting its maximum severity. Successful exploitation could lead to the total compromise of the underlying database and the host operating system, resulting in significant data breaches, loss of operational integrity, and potential regulatory non-compliance.

Immediate Action: Upgrade mysql_mcp_server to version 0.4.2 or later immediately to resolve the authentication and transport security flaws.

Proactive Monitoring: Review database access logs for unauthorized query patterns and monitor network traffic for unexpected interactions with the MCP server interface.

Compensating Controls: If immediate patching is not feasible, ensure the service is not exposed to the public internet and use network-level access controls to restrict connections to trusted management subnets.

Public Exploit Available: No

Given the critical nature of this vulnerability and the potential for full system compromise, organizations should prioritize the deployment of the 0.4.2 update across all affected environments. Failure to address this flaw leaves the database and host system exposed to trivial, unauthenticated remote attacks that require no specialized privileges to execute.