Bytebase - vulnerabilities (CVEs)

7 CVEs in 2 products, 3 in the last 30 days, newest from 2026-10-22.

Products

CVE-2022-51026 - CVSS 9.8 (critical), 2026-10-22: Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from…
CVE-2026-115322 - CVSS 5.3 (medium), 2026-10-22: Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated…
CVE-2026-115321 - CVSS 5.3 (medium), 2026-10-22: Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify…
CVE-2026-61788 - CVSS 7.4 (high), 2026-09-24: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the…
CVE-2026-61742 - CVSS 9.3 (critical), 2026-09-24: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint…
CVE-2022-32170 - CVSS 4.3 (medium), 2022-09-28: The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by…
CVE-2022-32169 - CVSS 4.3 (medium), 2022-09-28: The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED”…