CVE-2026-129127: SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sysuser.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to password recovery attacks?
Deployments using local SQLBot accounts are exposed if an attacker obtains the sys_user table. Accounts with weak or reused passwords, including administrator accounts, are particularly at risk because unsalted MD5 hashes can be cracked with precomputed tables or GPU-based cracking.
What does an attacker need to exploit this issue?
The attacker must first obtain the user table containing sys_user.password values. The vulnerability does not itself describe a way to access that table; it makes passwords recoverable after the hashes are obtained.
Are identical passwords detectable from the stored hashes?
Yes. Because the MD5 hashes are unsalted, identical passwords produce identical hash values, allowing anyone with the table to identify accounts that share the same password.
What should teams do if they cannot immediately update?
The provided information does not specify a workaround. Prioritize protecting access to the user table and rotate local-account passwords, especially administrator passwords and passwords reused elsewhere.