{
 "id": "AIR-2026-0126",
 "slug": "cve-2026-59971-mysql-mcp-server-lacks-authentication-and-dns",
 "title": "CVE-2026-59971: MySQL MCP Server lacks authentication and DNS protection",
 "summary": "MySQL MCP Server binds to all interfaces without authentication and lacks DNS rebinding protection under certain transport settings. Network attackers can directly execute database queries or use DNS rebinding against victims.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "MySQL MCP Server"
 ],
 "incident_date": "2026-09-15",
 "incident_date_precision": "day",
 "first_reported": "2026-09-15",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59971",
   "publisher": "NVD",
   "title": "CVE-2026-59971: MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases.",
   "published_at": "2026-09-15"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-59971",
  "dns_rebinding",
  "mcp"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}