MySQL EUVD-2026-12138

User must have valid AnythingLLM authentication credentials to invoke the SQL Agent plugin. The SQL Agent plugin must be enabled and configured with active database connections (MySQL, PostgreSQL, or MSSQL). Affects AnythingLLM versions 1.11.1 and earlier.

Despite the high CVSS score of 7.7, this vulnerability presents moderate real-world risk due to several mitigating factors. The attack vector is network-based but requires high attack complexity (AC:H) and present attack requirements (AT:P), suggesting specific conditions must be met for exploitation. Authentication is required (PR:L), limiting the attack surface to users who already have legitimate access to invoke the SQL Agent. The vulnerability is not listed in CISA KEV, indicating no known active exploitation in the wild. Without EPSS data or public POCs available, the immediate exploitation risk appears lower than the CVSS score suggests. However, the potential for high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) means organizations using AnythingLLM with database connections should prioritize remediation.

An authenticated attacker with access to AnythingLLM could craft malicious table names containing SQL injection payloads when invoking the SQL Agent to query database schemas. By manipulating the table_name parameter passed to getTableSchemaSql(), the attacker could execute arbitrary SQL commands such as extracting sensitive data, modifying records, or potentially gaining deeper system access depending on database permissions. The high attack complexity suggests the attacker would need specific knowledge of the application's database structure and potentially chain multiple requests to achieve meaningful exploitation.