SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries… (CVE-2026-86123)

CVE-2026-86123 describes a critical vulnerability in SQL Chat where four unauthenticated API endpoints accept client-supplied database connection parameters and execute arbitrary SQL queries against hosts specified by the attacker. This flaw allows attackers to connect to internal databases, run SQL commands, enumerate database schemas, and pivot into the server's network without any authentication. The vulnerability is classified under CWE-918 (Server-Side Request Forgery), indicating that the server can be coerced into making unauthorized requests to internal resources. The CVSS v3.1 score is 8.7, reflecting high impact on confidentiality and integrity with no privileges or user interaction required, but with high attack complexity.

An attacker can exploit this vulnerability to gain unauthorized access to internal databases, execute arbitrary SQL commands, and enumerate database schemas. This can lead to disclosure of sensitive data and potentially allow the attacker to pivot into the internal network, increasing the risk of further compromise. The vulnerability does not affect availability but has a critical impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the product is not a cloud service, users should monitor vendor communications for updates. Until a patch is available, restricting access to the vulnerable API endpoints and implementing network-level controls to prevent unauthorized access to internal databases may help mitigate risk.