ProxySQL's GenAI/MCP run_sql_readonly tool in versions 3.0.0 through 3.0.8 improperly validates SQL input by only checking the first keyword against an allowlist and applying a substring blacklist. However, it executes the entire SQL string on a backend connection with CLIENT_MULTI_STATEMENTS enabled. This allows an attacker to submit a read-only first statement followed by side-effecting statements such as RENAME TABLE, SET, RESET, LOCK TABLES, or KILL, which are not blocked by the blacklist. Consequently, the tool violates its read-only guarantee, enabling callers to perform backend writes or administrative SQL commands limited by the MCP target account's privileges. The vulnerability is addressed in version 3.0.9. Additional operator mitigations include disabling MCP when not required, enforcing authentication on the /mcp/query endpoint, restricting network access, using read-only backend credentials, and applying query rules to block multi-statement patterns.

An unauthenticated remote attacker can bypass the intended read-only restriction of the run_sql_readonly tool and execute side-effecting SQL statements on the backend MySQL database. This can lead to unauthorized administrative actions such as renaming tables or altering database state, constrained only by the privileges of the MCP target account. The vulnerability does not impact confidentiality or availability directly but results in high integrity impact due to unauthorized data modification.

A fix is available in ProxySQL version 3.0.9. Users should upgrade to this version to resolve the vulnerability. Until upgrading, operators should disable the MCP feature if it is not required, configure a non-empty mcp-query_endpoint_auth token to enforce authentication on the /mcp/query endpoint, restrict network exposure of the MCP listener, ensure MCP backend target credentials are limited to database-level read-only users, and implement temporary MCP query rules to block multi-statement SQL patterns that could exploit this issue.