CVE-2026-86123: SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker that can reach the affected API endpoints can supply database connection details and SQL queries. No account or user interaction is required.
What systems are at risk beyond the SQL Chat server itself?
Databases and other reachable database services on the SQL Chat server's internal network may be exposed because an attacker can direct the server to connect to attacker-specified hosts. This can enable schema enumeration, SQL command execution, and network pivoting.
Is there a safe default configuration indicated by the available information?
No. The reported endpoints are described as unauthenticated, and the available information does not identify a configuration setting that restricts them by default.
How can I determine whether my deployment is exposed?
Determine whether the /api/connection endpoints are reachable by untrusted networks and whether they accept client-supplied connection parameters without authentication. Review access logs for requests to those endpoints, particularly requests containing unexpected internal hostnames, addresses, or database connection details.