CVE-2026-79536 Details

A SQL injection vulnerability has been identified in Bytebase DBHub version 1.2.0 and earlier, within the SQL parser component. This vulnerability allows attackers to bypass the application's read-only mode on MySQL and MariaDB databases, enabling them to execute write operations or destructive data definition language commands, such as dropping tables. The issue arises because the SQL classifier used to enforce read-only mode fails to recognize certain comment syntax, allowing malicious SQL statements to be crafted and executed.

To address this vulnerability, disable `multipleStatements` on the database connection to prevent stacked statements from executing based on the classifier's assessment. Additionally, enforce read-only access at the database level using a read-only transaction or a least-privilege database account, and update the SQL classifier to properly parse `#` comments in accordance with the target SQL dialect's default mode.