Executive brief
SQL Chat is a web-based SQL client and editor that allows users to query databases. The application exposes unauthenticated API endpoints that accept arbitrary database connection parameters from clients, allowing attackers to bypass authentication and connect to any database they choose—including internal or production databases—to execute arbitrary SQL commands, steal data, and pivot into the server's network.
Technical details
The vulnerability is an authentication bypass and SQL injection flaw in SQL Chat's API endpoints (specifically /api/connection/execute and at least three others). The endpoints accept client-supplied database connection parameters (host, port, credentials) in the request body without authentication or validation, and directly execute attacker-controlled SQL statements against those databases. An unauthenticated attacker can send a POST request with arbitrary connection details and SQL queries to connect to internal databases, enumerate schemas, exfiltrate sensitive data, or execute destructive commands. The vulnerable code passes user-supplied connection objects directly to the connector without validation. No authentication is required, and the API is reachable over the network. Patches addressing input validation and authentication checks are likely available.
Affected products
- SQL Chat SQL Chat prior to patch
Timeline
- 2026-09-05: disclosed
- other: CVE-2026-86123 assigned