Which versions of Aix-DB are affected by CVE-2026-8335?

Aix-DB versions 1.2.4 and earlier contain an unauthenticated SQL data exfiltration vulnerability with no public exploit identified at time of analysis, but trivial exploitation complexity once…

How to fix or mitigate CVE-2026-8335?

Within 24 hours: Audit all Aix-DB deployments to identify versions ≤1.2.4; implement network access controls blocking the /llm/process_llm_out endpoint via WAF or network ACLs to deny unauthenticated queries. Within 7 days: Monitor vendor security advisories and contact Aix-DB support for patch timeline; restrict database access to trusted networks only via IP whitelisting and disable direct endpoint exposure. Within 30 days: Deploy vendor-released patch to all Aix-DB instances immediately upon availability; if no patch is released by end of month, initiate evaluation of alternative database platforms.

Aix-DB CVE-2026-8335

Q: What is the CVSS score of CVE-2026-8335?

CVE-2026-8335 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36050 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-10 CERT-PL

GHSA-x546-prg5-fvp8

Authentication Bypass Aix Db

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:35 vuln.today

CVSS changed

Jun 10, 2026 - 15:22 NVD

7.1 (HIGH)

DescriptionNVD

A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.

AnalysisAI

Unauthenticated SQL data exfiltration in Aix-DB versions up to and including 1.2.4 allows attackers on adjacent networks to issue arbitrary SELECT queries against the application's database through the /llm/process_llm_out endpoint, which omits the token validation enforced on every other application route. The flaw was disclosed by CERT-PL and currently has no public exploit identified at time of analysis, but the CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VC:H) reflects trivial exploitation once an attacker reaches the deployment network. No vendor-released patch identified at time of analysis.

Technical ContextAI

Aix-DB (cpe:2.3:a:aix-db:aix-db:*:*:*:*:*:*:*:*) is an LLM-backed database query application whose REST API normally gates requests with a token check. The /llm/process_llm_out endpoint, designed to handle LLM-generated SQL output, was implemented without that middleware, mapping directly to CWE-306 (Missing Authentication for Critical Function). Because the endpoint passes user-supplied SELECT statements straight through to the underlying datastore, any caller who can reach the HTTP listener can read database contents without first holding or forging an application token.

RemediationAI

No vendor-released patch identified at time of analysis, so until the apconw/Aix-DB maintainers publish a fix that enforces the standard token middleware on /llm/process_llm_out, operators should apply compensating controls: place Aix-DB behind a reverse proxy or WAF that requires authentication on the /llm/process_llm_out path (trade-off: breaks any legitimate client that depends on the unauthenticated behaviour), restrict network reachability of the Aix-DB listener to a trusted management segment using host or network firewalls to neutralise the AV:A vector, and monitor application/database logs for unexpected SELECT activity sourced from the LLM pipeline. Track the upstream repository at https://github.com/apconw/Aix-DB and CERT-PL's advisory at https://cert.pl/posts/2026/06/CVE-2026-8335 for an official fixed version.