Pillar Security discloses a Dolt MCP authentication bypass vulnerability; unauthenticated callers can execute database tools

Pillar Security discovers an authentication bypass vulnerability in the DoltHub remote Dolt MCP server, affecting versions 0.3.1 through 0.3.6, fixed in 0.3.7. The vulnerability is caused by the combination of two defects: the JWT middleware writes a 401 response when the token is invalid but lacks a return, so processing continues downward; meanwhile, the mark3labs/mcp-go default session manager only validates the format of the Mcp-Session-Id, not whether it was issued by the server. An attacker can therefore reach the tool distribution stage with a forged JWT and a self-made session ID, execute operations using the server's own database credentials, and the results are appended to the 401 response body, so logs that only monitor status codes will mistakenly judge the attack as failed. The impact is limited to remote HTTP transports with JWT authentication enabled; local stdio is not affected. The operations that can be executed depend on the database permissions of the MCP server account, including reading, modifying, or deleting data.