A critical vulnerability in Bytebase DBHub allows unauthenticated remote attackers to bypass origin validation and execute unauthorized database operations, posing a severe risk to data integrity and confidentiality.

This vulnerability involves a failure in origin validation during HTTP transport mode, specifically susceptible to DNS rebinding. This flaw allows an unauthenticated attacker to bypass security checks and invoke MCP tools, granting unauthorized access to the underlying database.

The exploitation of this vulnerability can lead to unauthorized read, enumeration, and modification of database contents. Given the CVSS score of 9.3, this represents a critical risk where attackers could exfiltrate sensitive data or disrupt business operations by tampering with database records.

Immediate Action: Upgrade Bytebase DBHub to version 0.22.5 or later immediately to resolve the origin validation flaw.

Proactive Monitoring: Review web server and application access logs for unusual traffic patterns or unexpected requests originating from external hostnames.

Compensating Controls: If an immediate update is not feasible, ensure that the DBHub instance is not exposed to the public internet and restrict access to trusted networks or via a VPN.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a high risk due to the potential for unauthenticated database manipulation. Organizations utilizing DBHub in HTTP transport mode must prioritize the deployment of version 0.22.5 to close this security gap. Failure to patch allows for potential large-scale data exposure if the service is reachable by an attacker-controlled browser.