Skip to content
Threat Feed
Subscribe

Product

Anyquery (< 0.4.5)

1 brief RSS
high advisory

Anyquery Server-Side Request Forgery via Unrestricted SQLite Virtual Table Modules

Unauthenticated attackers can exploit a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-54628) in Anyquery's `server` mode (versions prior to 0.4.5) by creating SQLite virtual tables that fetch internal network resources or cloud metadata, leading to internal network mapping and exfiltration of sensitive information like cloud credentials.

Anyquery ssrf vulnerability local-file-read linux data-exfiltration
3r 4t