Is CVE-2026-54628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54628 being exploited in the wild.

How severe is CVE-2026-54628?

High severity, with a CVSS score of 8.6, published 14 September 2026.

Which products and versions are affected?

github.com/julien040/anyquery (Go) < 0.4.5, SEMVER:introduced=0; Julien040 Anyquery < 0.4.5.

Is there a fix for CVE-2026-54628?

A patch was published on 2026-07-14: Version 0.4.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54628 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54628?

Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54628: Anyquery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode

Q: Is there a fix for CVE-2026-54628?

A patch was published on 2026-07-14: Version 0.4.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54628 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54628?

Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54628 · Severity: high · CVSS 8.6 · Published 2026-09-14

Anyquery is a tool that allows users to run SQL queries on various data sources like JSON files or logs. When running in server mode, it fails to restrict where it can fetch data from, allowing an attacker to force the server to make requests to internal systems. This could lead to the theft of sensitive cloud credentials or unauthorized access to private internal services that are not normally accessible from the internet.

Technologies: github.com/julien040/anyquery (Go), Julien040 Anyquery. Vendors: Go, Julien040.

Quick answers

Is CVE-2026-54628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54628 being exploited in the wild.
How severe is CVE-2026-54628?: High severity, with a CVSS score of 8.6, published 14 September 2026.
Which products and versions are affected?: github.com/julien040/anyquery (Go) < 0.4.5, SEMVER:introduced=0; Julien040 Anyquery < 0.4.5.
Is there a fix for CVE-2026-54628?: A patch was published on 2026-07-14: Version 0.4.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54628 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54628?: Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Anyquery's 'server' mode accepts MySQL protocol connections and allows the creation of dynamic virtual tables using modules such as 'json_reader' or 'log_reader'. These modules utilize the 'go-getter' library to fetch remote URLs without validating or restricting the destination IP addresses. An unauthenticated remote attacker can exploit this Server-Side Request Forgery (SSRF) vulnerability to probe internal network services (127.0.0.1, 10.0.0.0/8) or exfiltrate sensitive IAM credentials from Cloud Metadata services (169.254.169.254). The vulnerability is addressed in version 0.4.5 by implementing restrictions on local and private IP ranges.

Affected products

julien040 anyquery < 0.4.5

Identifiers

CVE-2026-54628
GHSA-hwrq-8wxh-q4xv
GO-2026-5988

Timeline

2026-06-09: disclosed: Initial disclosure by reporter
2026-07-14: advisory: GitHub Advisory published
2026-07-14: patched: Version 0.4.5 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.