Lose Control Flow: Unauthenticated Tool Execution in Dolt MCP

What it is

An authentication bypass in DoltHub's remote Dolt MCP server (versions 0.3.1–0.3.6, fixed in 0.3.7), reported by Pillar Security and coordinated via a GitHub Security Advisory. Dolt is a Git-style SQL database marketed as "the Database for Agents"; its MCP server turns AI-client instructions into database operations run under the server's own credentials, making it a trust boundary. The bug lets an unauthenticated caller reach tool dispatch despite failing JWT auth.

How it works

Two defects had to line up:

• Missing return after rejection. The JWT middleware handled missing tokens (401, stop) differently from invalid tokens: an invalid token called http.Error — which in Go writes the response but does not halt the handler — and execution fell through to next.ServeHTTP, passing the rejected request into MCP handling.
• Syntax-only session validation. The session protocol required an Mcp-Session-Id. The mark3labs/mcp-go library's default InsecureStatefulSessionIdManager only checked that the value started with mcp-session- and ended with a valid UUID. It never consulted a registry of server-issued sessions, so an attacker-fabricated ID passed. A properly stateful manager would have rejected the forged ID and blunted the fall-through.

The reader's key takeaway: the response still returns 401 Unauthorized, but the operation executes and its result appears in the response body. Detections keying on the 401 as proof of rejection are misleading here.

Preconditions / Affected

• Remote HTTP transport with JWT authentication enabled. Local stdio use is not affected.
• Dolt MCP 0.3.1 through 0.3.6.
• Impact scales with the MCP server account's database privileges — read, query, modify/delete, and invocation of any other exposed Dolt MCP tools.

flowchart TD
    A[Request, invalid JWT] --> B[http.Error 401]
    B -->|missing return| C[next.ServeHTTP]
    B -.->|correct: return here| Z[Rejected]
    C --> D{Session ID check}
    D -->|registry check| Z
    D -->|syntax only| E[Tool dispatch runs under server creds]

What to do

• Self-hosted users: upgrade to Dolt MCP 0.3.7 or later. DoltHub already patched its hosted infrastructure.
• The page gives no CLI commands, only the version fix.

Caveats

• The page states DoltHub confirmed and patched hosted infra within hours; self-hosted deployments are the residual exposure.
• The broader design point the page makes: an auth error must terminate execution, and an MCP server must bind caller → authorized operation → session state → credential for every downstream effect — the insecure session manager is a library default worth auditing in other mark3labs/mcp-go deployments.