[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) Publish date October 8, 2026 {x} minute read # Data leakage risks with DBHub MCP servers [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-lean-security-teams-playbook-for-dark-web-incident-response) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Whitepaper The Lean Security Team's Playbook for Dark Web incident Response Free resource ### The Lean Security Team's Playbook for Dark Web incident Response [Download now](/resources/the-lean-security-teams-playbook-for-dark-web-incident-response) Organizations keep their databases behind firewalls for a reason: the data inside is the data they can least afford to lose. A new class of AI middleware–Model Context Protocol (MCP) servers–exists specifically to reach into those protected systems on an AI model's behalf. One of them, DBHub, connects directly to SQL databases. DBHub thus enables a user to ask AI a question and have it execute an appropriately formed SQL query to get the answer–a natural language interface for company databases that can be very helpful until that interface is exposed to the public. DBHub’s intrinsic connection to databases makes their exposure a useful bellwether for MCP exposures becoming meaningful in severity and scale. Most internet-accessible MCP servers wrap public APIs, providing a better interface for AI agents but the same risk profile. DBHub, on the other hand, connects to the one place organizations work hardest to keep private. As noted in a [Github issue a year ago](https://github.com/bytebase/dbhub/issues/66), the HTTP interface lacks authentication, making an accessible DBHub instance an accessible database.  UpGuard scanned the public internet for DBHub and found 31 instances already exposed, most of them able to run live SQL against real production data, several holding PII and medical records. The individual misconfigurations are familiar. What's new is the surface: MCP is being adopted quickly, it points at high-value data by design, and the early evidence suggests that MCP specifically designed for use cases like database querying will become a real vector for data exposure. ## What DBHub is, and how it exposes data The MCP project describes the protocol as "a USB-C port for AI applications" — a single standardized way to connect AI tools to external systems, replacing the bespoke, fragile, one-off integrations that each new data source used to require. One protocol, many connections. Previously, every time an AI model had to connect to a new tool or data source, custom integration code was required: one integration for GitHub, another for Slack, and yet another for local databases. Each one is bespoke, fragile, and requires ongoing maintenance. MCP addresses this with [a single standardized connection layer](https://www.upguard.com/blog/mcp-ai-protocol-expanding-your-attack-surface) for AI agents and external tools: one protocol with infinite connections. Essentially, these MCP servers act as wrappers for APIs that are already public. While they [do have their own issues](https://www.upguard.com/blog/mcp-server-lookalikes), including [a sophisticated attack using MCP servers](https://www.straiker.ai/blog/smartloader-clones-oura-ring-mcp-to-deploy-supply-chain-attack) as an entrypoint, they are not prone to expose data in the same way as DBHub. ### DBHub [DBHub](https://dbhub.ai/) acts as a specific kind of MCP server that provides AI with access to databases to simplify user queries. Rather than giving every user the connection string to a database (or databases), DBHub acts a hub where users send questions and it returns answers. DBHub supports MySQL, Microsoft’s SQL Server, PostgreSQL, SQLite and MariaDB. DBHub allows AI agents or platforms to run SQL commands against connected databases.  To its credit, DBHub ships with guardrails — read-only mode, row limiting, query timeouts — and supports SSH tunneling with SSL/TLS encryption. None of that helps when the server itself is placed on the public internet. The databases and the AI can stay private; if the DBHub instance in the middle has a public IP and an open MCP port — whether deliberately exposed through the firewall or simply never put behind one — the data is reachable. When the DBHub server is misconfigured and faces the public internet, the data in the database becomes at risk, even if both the database server and the AI are private. This configuration, core to how MCP servers in general operate, is how the DBHub servers discovered by UpGuard researchers came to expose their data. They were given a public IP address and the MCP port in use was opened through the firewall (or it simply wasn’t behind one to begin with.)  The execute\_sql tool is a plain text box and a Run button. From here, accessing the table structure and exfiltrating the data is just a matter of simple queries. Perhaps operators are not wholly aware that in addition to providing access to AI tools, DBHub has a web-interface for human interaction. Putting the DBHub server on the internet exposes it. The web interface provides one other feature when browsing to it, a log of recent requests, showing (by default) the previous 100 queries run against the DBHub system. This provides further intelligence and context for how the operator uses the database and what valuable data might be present. ## What’s already exposed  Of the 31 discovered servers, 25 (81%) were verified to have *execute\_sql* permissions active, meaning SQL queries and commands could be given to the database via the exposed DBHub instance. Of these 25, UpGuard researchers were able to sample data on 22 systems, revealing a wide range of industries and uses for the DBHub servers. Also widely varied were the DBHub versions of the discovered systems, which ranged from 0.15.0 to 0.21.2. Older versions of DBHub have known security issues and provide opportunity for even further compromise. UpGuard notified organizations with personally identifiable information present. In addition to sensitive data being discovered, plain text API credentials were also present on two systems, the misuse of which could allow threat actors to modify or compromise further systems and data. ## **The takeaway** DBHub is the clearest early example of where MCP exposure leads: an AI-enabling layer that connects, by design, to the data organizations most want to protect, already sitting open on the public internet in real deployments. The number of MCP servers in use will rise sharply as these tools are adopted, and each new one is a potential door to meaningful data. New functionality has always come with new gaps. Whether a gap stays a misconfiguration or becomes an incident depends on how quickly it's detected and closed — and how well security practice adapts to the new vector. Rushing into AI integration without planning for that will only get more dangerous as the technology becomes more common and more powerful. Whitepaper The Lean Security Team's Playbook for Dark Web incident Response Free resource ### The Lean Security Team's Playbook for Dark Web incident Response [Download now](/resources/the-lean-security-teams-playbook-for-dark-web-incident-response) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 1, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Understanding and Mitigating CVE-2025-55182 (React2Shell)](/blog/understanding-and-mitigating-cve-2025-55182-react2shell) CVE-2025-55182 is a critical unauthenticated RCE in React Server Components (CVSS 10.0). Check if your Next.js or React 19 app is vulnerable and patch now. [](/team/edward-kost) [Edward Kost](#) December 14, 2025 Risks and Vulnerabilities #### [Downstream Data: Investigating AI Data Leaks in Flowise](/blog/downstream-data-investigating-ai-data-leaks-in-flowise) A thousand Flowise instances are exposed to the internet, many of them leaking confidential business data, passwords, and more. [](/team/greg-pollock) [Greg Pollock](#) July 2, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)