Is CVE-2026-54629 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54629 being exploited in the wild.

How severe is CVE-2026-54629?

High severity, with a CVSS score of 7.5, published 14 September 2026.

Which products and versions are affected?

github.com/julien040/anyquery (Go) < 0.4.5, SEMVER:introduced=0; Julien040 Anyquery < 0.4.5.

Is there a fix for CVE-2026-54629?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54629 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54629?

Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54629: Anyquery local file read via unrestricted SQLite virtual tables

Q: Is there a fix for CVE-2026-54629?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-54629 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54629?

Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54629 · Severity: high · CVSS 7.5 · Published 2026-09-14

Anyquery, a tool for querying data using SQL, contains a vulnerability in its server mode that allows unauthorized access to local files. By connecting to the server's database port, an attacker can read sensitive system files, such as passwords or private keys, that the application has permission to access. This could lead to a complete compromise of the host system's data confidentiality.

Technologies: github.com/julien040/anyquery (Go), Julien040 Anyquery. Vendors: Go, Julien040.

Quick answers

Is CVE-2026-54629 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54629 being exploited in the wild.
How severe is CVE-2026-54629?: High severity, with a CVSS score of 7.5, published 14 September 2026.
Which products and versions are affected?: github.com/julien040/anyquery (Go) < 0.4.5, SEMVER:introduced=0; Julien040 Anyquery < 0.4.5.
Is there a fix for CVE-2026-54629?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54629 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54629?: Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Anyquery utilizes the hashicorp/go-getter library within its data ingestion modules. When launched in Server Mode, it binds to a TCP port and accepts MySQL protocol connections without restricting virtual table modules (like csv_reader or log_reader) to safe directories. An unauthenticated remote attacker can execute native SQLite virtual table creation queries to point these modules at sensitive local files (e.g., /etc/passwd). Because the file read operation is initiated by the Anyquery server process, the attacker can read any file the process has permissions to access. The vulnerability is addressed in version 0.4.5.

Affected products

julien040 anyquery < 0.4.5

Identifiers

CVE-2026-54629
GHSA-mf78-3rpf-r784
GO-2026-5990

Timeline

2026-06-09: disclosed: Initial disclosure by reporter Metincloup
2026-07-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.