PT-2026-26556 · Sqlbot · Sqlbot

Jackieya · Publicado 2026-03-20 · Atualizado 2026-03-20 · CVE-2026-32949

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.7.0

Description SQLBot is a data query system utilizing a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) issue that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the /api/v1/datasource/check endpoint by configuring a forged MySQL data source with a malicious parameter extraJdbc='local infile=1'. When the SQLBot backend attempts to verify the connectivity of this data source, an attacker-controlled MySQL server issues a malicious LOAD DATA LOCAL INFILE command during the MySQL handshake. This forces the target server to read arbitrary files from its local filesystem and transmit the contents back to the attacker.

Recommendations Update SQLBot to version 1.7.0 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-73

CWE-918

Identificadores relacionados

CVE-2026-32949

GHSA-WQJ3-XCXF-J9M9

Produtos afetados

Sqlbot

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32949.json · Exploit
• https://github.com/dataease/SQLBot/commit/ff98514827bad99b8fa4b39385adecc6e3d44355 · Correção
• https://github.com/dataease/SQLBot/security/advisories/GHSA-wqj3-xcxf-j9m9 · Aviso do Fabricante
• https://github.com/dataease/SQLBot/releases/tag/v1.7.0 · Nota
• https://twitter.com/CVEnew/status/2034891563629683139 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32949 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32949 · Aviso do Fabricante