CVE-2026-124850: SQL Injection in Database Migration via Stored Connector Identifiers in flowintel

Q: Who is exposed to exploitation?

Organizations running flowintel versions earlier than 4.0.0 are exposed if an attacker has already been able to write a malicious connector identifier into the affected database tables. The injection executes when a later application upgrade runs the migration.

Q: Does an attacker need access at the time of the upgrade?

Not necessarily. The attacker must first obtain write access to the database to plant a malicious identifier value, but the stored value is processed automatically when the migration runs.

Q: What is the impact if the migration processes a malicious identifier?

The migration can execute arbitrary SQL. This can lead to unauthorized disclosure, modification, or deletion of data.

Q: How can I determine whether my deployment is affected?

Check whether the deployment is running a flowintel version prior to 4.0.0 and whether untrusted or unauthorized database writes could have altered stored connector identifier values. Review those values before performing an upgrade migration.

Published Nov 9, 2026

Updated

A SQL injection vulnerability exists in a database migration script in flowintel.

The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.

- Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion

Affected versions: flowintel prior to 4.0.0

Affected Software

1 affected component

FlowIntel FlowIntel<4.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade flowintel to a version that resolves this vulnerability.
Fixed in 4.0.0

Event History

Nov 9, 2026

CVE Published

via MITRE·02:43 PM

Data Sourced

via MITRE·02:43 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Organizations running flowintel versions earlier than 4.0.0 are exposed if an attacker has already been able to write a malicious connector identifier into the affected database tables. The injection executes when a later application upgrade runs the migration.

Does an attacker need access at the time of the upgrade?

Not necessarily. The attacker must first obtain write access to the database to plant a malicious identifier value, but the stored value is processed automatically when the migration runs.

What is the impact if the migration processes a malicious identifier?

The migration can execute arbitrary SQL. This can lead to unauthorized disclosure, modification, or deletion of data.

How can I determine whether my deployment is affected?

Check whether the deployment is running a flowintel version prior to 4.0.0 and whether untrusted or unauthorized database writes could have altered stored connector identifier values. Review those values before performing an upgrade migration.

CVE-2026-124850: SQL Injection in Database Migration via Stored Connector Identifiers in flowintel

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

Does an attacker need access at the time of the upgrade?

What is the impact if the migration processes a malicious identifier?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

Does an attacker need access at the time of the upgrade?

What is the impact if the migration processes a malicious identifier?

How can I determine whether my deployment is affected?