CVE-2026-8335: Missing authentication in Aix-DB
A missing authentication check on the Aix‑DB "/llm/processllmout" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce the same token validation/authentication on the /llm/process_llm_out endpoint as is enforced on other application endpoints to prevent unauthenticated clients from executing arbitrary SELECT queries and retrieving database data.
Aix-DB /llm/process_llm_out authentication/token validation = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8335?
CVE-2026-8335 has a severity rating of 76, indicating a high level of risk due to missing authentication.
How do I fix CVE-2026-8335?
To fix CVE-2026-8335, implement authentication checks on the '/llm/process_llm_out' endpoint to validate token access.
What impact does CVE-2026-8335 have on Aix-DB?
CVE-2026-8335 allows unauthenticated clients to execute arbitrary SQL 'SELECT' queries, potentially exposing sensitive database information.
Which versions of Aix-DB are affected by CVE-2026-8335?
All versions of Aix-DB up to and including 1.2.4 are affected by CVE-2026-8335 due to the missing authentication check.
How can I verify if my installation of Aix-DB is vulnerable to CVE-2026-8335?
To verify if your installation is vulnerable, check if the version is 1.2.4 or below and conduct tests on the '/llm/process_llm_out' endpoint for authentication.