DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61742: CVE-2026-61742: DNS Rebinding to Unauthenticated SQL Execution in DBHub

#security #cve #cybersecurity

CVE-2026-61742: DNS Rebinding to Unauthenticated SQL Execution in DBHub

Vulnerability ID: CVE-2026-61742
CVSS Score: 9.3
Published: 2026-09-24

A critical DNS rebinding vulnerability in DBHub (associated with GHSA-fm8p-53ww-hf6w) allows unauthenticated remote attackers to execute arbitrary SQL queries against local and internal databases. By exploiting a relative origin validation check within the HTTP transport middleware, an attacker can bypass same-origin protections via DNS rebinding. This allows malicious external websites to send JSON-RPC commands to the local DBHub service to read, write, and exfiltrate database contents. The issue affects all versions of DBHub prior to 0.22.5.

TL;DR

Unauthenticated remote SQL execution on local DBHub database servers via client-side DNS rebinding.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-346
  • Attack Vector: Network
  • CVSS v4.0 Score: 9.3
  • EPSS Score: N/A (Published 2026)
  • Impact: Unauthenticated arbitrary SQL Execution / Information Disclosure
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • @bytebase/dbhub
  • DBHub Server (HTTP transport mode)
  • @bytebase/dbhub: < 0.22.5 (Fixed in: 0.22.5)

Code Analysis

Commit: 5bf5c32

Refactor cross-origin validation to use strict host allowlist policy instead of relative origin-host equality comparison.

Exploit Details

Mitigation Strategies

  • Upgrade DBHub to version 0.22.5 or above to apply strict host allowlisting.
  • Restrict service binding explicitly to loopback interface 127.0.0.1 instead of wildcard interfaces 0.0.0.0.
  • Deploy a reverse proxy (e.g., Nginx, Apache, or Caddy) in front of the HTTP endpoint to enforce authentication and validate host headers.

Remediation Steps:

  1. Run 'npm install @bytebase/dbhub@latest' to update the package dependency.
  2. Verify the version is at least 0.22.5 by inspecting the package-lock.json or running 'npx @bytebase/dbhub --version'.
  3. If configuration overrides are needed, pass the authorized domain names via the '--allowed-hosts' CLI argument or the 'DBHUB_ALLOWED_HOSTS' environment variable.

References

Read the full report for CVE-2026-61742 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)