bytebase has 5 CVEs on record. 4 were published in the last 90 days. The median CVSS is 7.4 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: bytebase (2), dbhub (2), github.com/bytebase/bytebase (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- bytebase 2
- dbhub 2
- github.com/bytebase/bytebase 1
Worst active — by depth score
CVE-2026-61742Critical· 9.3DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite63CVE-2022-51026Medium· 9.8Bytebase vulnerable to Improper Authentication54CVE-2026-61788High· 7.4DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite53CVE-2026-115322Medium· 4.3Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers24CVE-2026-115321Medium· 4.3Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment24
bytebase vulnerabilities
CVEs affecting bytebase, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-115322Medium· 4.3Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on…
CVE-2026-115321Medium· 4.3Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any …
CVE-2026-61788High· 7.4PoCDBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to s…
CVE-2026-61742Critical· 9.3PoCDBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport …
CVE-2022-51026Medium· 9.8Bytebase vulnerable to Improper Authentication
Bytebase vulnerable to Improper Authentication