AWS MCP server bug let SQL comments go through its read-only check

On 9 September 2026, AWS gave notice of bug CVE-2026-85788 in its MySQL MCP server, awslabs.mysql-mcp-server. This MCP server (a connection between an AI agent and tools) lets the agent use a MySQL database. In versions 1.0.21 and before, SQL comments in a statement could get it through the read-only check that must stop it.

How it works

Read-only mode checks each SQL statement before it operates. AWS reports that in some conditions a statement with SQL comments can go through the check and operate.

The fix

AWS repaired the bug in version 1.0.23. Install that version or a new version. Give the database user only the minimum privileges, and no FILE privilege unless it is necessary.

What is not known

AWS does not tell which conditions are necessary. It gives no sign that attackers use the bug. AWS reports that no AWS system is at risk, because customers install the package and control the credentials.

Insight: Set the limit in the database, not in the MCP check

In the same weeks, bugs in other MCP software let a bad MCP server get credentials or start code. Checks in MCP software have bugs again and again, and AWS puts the limit on the database account. Set the limit in the database, and do not use an MCP check as the only limit.