designcomputer/mysql_mcp_server

v0.4.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo MCP Data & Storage

✓ No known CVEs patched

This release patches 1 known CVE

Topics

ai claude claude-code database llm mcp

+3 more

mcp-server model-context-protocol mysql

Affected surfaces

auth breaking_upgrade

Summary

AI summary

DNS rebinding protection enabled for SSE, closing a reported attack vector.

Full changelog

SSE: DNS rebinding protection enabled — SseServerTransport now receives TransportSecuritySettings(enable_dns_rebinding_protection=True), validating Host and Origin headers against an allowlist. This closes the DNS rebinding attack vector reported in #92.
Default allowed hosts are localhost:{port} and 127.0.0.1:{port}. Operators deploying behind a reverse proxy can extend the list via MCP_SSE_ALLOWED_HOSTS (comma-separated).
Graceful fallback for older mcp versions that predate transport_security.

New Security Considerations note explaining that SSE has no built-in authentication and showing how to front it with an nginx reverse proxy (with MCP_SSE_HOST=127.0.0.1 and MCP_SSE_ALLOWED_HOSTS).
MCP_SSE_ALLOWED_HOSTS added to the .env example block.

SSE: DNS rebinding protection enabled (Host and Origin header allowlist validation) – closes CVE‑related attack vector reported in #92.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track designcomputer/mysql_mcp_server

Get notified when new releases ship.

About designcomputer/mysql_mcp_server

MySQL database integration with configurable access controls, schema inspection, and comprehensive security guidelines