EUVD-2026-71955
GHSA-7xvg-gx2w-r5cc
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF (PR:N) but requires knowing reachable internal targets (AC:H); scope changes to backend databases (S:C) with high confidentiality/integrity, no direct availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication.
AnalysisAI
Server-side request forgery in SQL Chat (the open-source sqlchat AI database client) lets remote unauthenticated attackers abuse four API endpoints (including /api/connection/execute and /api/connection/test) that accept client-supplied database connection parameters and run arbitrary SQL against any attacker-named host. Because no authentication is enforced, an attacker can point the server at internal databases, enumerate schemas, execute queries, and pivot through the SQL Chat host into otherwise unreachable network segments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a network-reachable SQL Chat deployment whose /api/connection/* endpoints (execute.ts, test.ts) are exposed without an authenticating front-end - the default handlers enforce no authentication (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/SC:H/SI:H, score 9.4) reflects real severity: network-reachable, unauthenticated (PR:N), with high confidentiality and integrity impact on both the vulnerable system and subsequent (internal) systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so treat this as unpatched pending confirmation from the maintainers (track the VulnCheck advisory and GitHub issue #189). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of SQL Chat in production and development environments and identify which are network-accessible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today