CVE-2026-86123 Details
Description
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication.
A vulnerability in SQL Chat allows unauthenticated users to exploit four API endpoints that accept database connection parameters and execute arbitrary SQL queries on specified hosts. This flaw enables attackers to access internal databases, execute SQL commands, enumerate database schemas, and pivot into the server's internal network without authentication. The issue arises from a lack of authentication and validation on the connection parameters, leaving internal services and data exposed.
Require authentication on all '/api/connection/*' endpoints and implement a global middleware to gate these endpoints. For self-hosted instances, add a configuration option to allowlist specific hosts or IP ranges. Consider rejecting connections to loopback, link-local, and private IP addresses unless explicitly allowed by the operator.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sqlchat/sqlchat/issues/189 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sqlchat/sqlchat | [email protected] | ProductSource CodeVendor |
| https://github.com/sqlchat/sqlchat/blob/665af875413affadfeefff81794f1d7758782bc2/src/pages/api/connection/execute.ts | [email protected] | Source CodeVendor |
| https://github.com/sqlchat/sqlchat/blob/665af875413affadfeefff81794f1d7758782bc2/src/pages/api/connection/test.ts | [email protected] | Source CodeVendor |
| https://github.com/sqlchat/sqlchat/issues/189 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/sql-chat-unauthenticated-database-connection-proxy-in-the-api-connection-endpoints | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SQL Chat | <= 665af875413affadfeefff81794f1d7758782bc2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |