Unauthenticated SQL Injection and Database Access in SQL Chat

SQL Chat contains four unauthenticated API endpoints that fail to sanitize client-supplied database connection parameters. This vulnerability, tracked as CVE-2026-86123, allows remote, unauthenticated attackers to force the application to establish connections to arbitrary external or internal database hosts. Once connected, an attacker can execute arbitrary SQL queries, enumerate database schemas, and potentially exfiltrate sensitive data. Furthermore, because these connections originate from the SQL Chat server itself, the vulnerability provides an attacker with a foothold to pivot into internal network segments that may not be directly reachable from the internet. This issue is critical for organizations deploying SQL Chat in environments with access to sensitive internal database resources, as it bypasses standard authentication and access controls for the database layer.

Impact

The vulnerability poses a significant risk to data confidentiality and network integrity. Successful exploitation enables unauthorized schema enumeration and data exfiltration from any database the SQL Chat server can reach. In segmented networks, the service can be leveraged to bypass perimeter firewalls, allowing attackers to reach and interact with internal-only database instances.

Recommendation

1. Patch immediately: Ensure SQL Chat is updated to the latest available version that contains the fix for CVE-2026-86123.
2. Network isolation: Restrict the network reachability of the SQL Chat server using host-based firewalls or VPC security groups to only those database hosts that are strictly required for its operation.
3. Monitoring: Monitor web access logs for unauthenticated POST requests to API endpoints responsible for database configuration or connection establishment.
4. Database auditing: Enable audit logging on database servers accessible by the SQL Chat instance to detect unauthorized queries or abnormal connection patterns.