CVE-2026-33324: SQLBot Text-to-SQL SQLi Vulnerability

CVE-2026-33324 Overview

CVE-2026-33324 is a prompt injection vulnerability in SQLBot, an intelligent Text-to-SQL system built on large language models (LLMs) and Retrieval-Augmented Generation (RAG). The flaw affects versions 1.7.0 and earlier. The Text2SQL chat interface concatenates the user-supplied question parameter directly into the LLM prompt without filtering or escaping. SQL extracted from the LLM response then executes against the database without validation. An authenticated attacker can craft malicious input to coerce the LLM into generating arbitrary SQL statements. When SQLBot connects to a PostgreSQL data source, the attacker can achieve remote code execution through the COPY FROM PROGRAM statement. The issue is fixed in version 1.7.1.

Critical Impact

Authenticated attackers can execute arbitrary SQL and gain remote code execution on PostgreSQL-backed SQLBot deployments via prompt injection.

Affected Products

• SQLBot versions 1.7.0 and earlier
• Deployments connected to PostgreSQL data sources are exposed to remote code execution
• Fixed release: SQLBot version 1.7.1

Discovery Timeline

• 2026-05-05 - CVE-2026-33324 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-33324

Vulnerability Analysis

SQLBot translates natural language questions into SQL using an LLM augmented with RAG context. The question parameter submitted to the Text2SQL chat endpoint is interpolated into the model prompt as raw text. No sanitization, instruction isolation, or output validation exists between the user input, the LLM, and the database execution layer. An authenticated attacker submits a question that overrides system instructions and dictates the SQL the model returns. SQLBot then executes that SQL directly against the configured data source. The vulnerability is classified under [CWE-89] for improper neutralization of SQL elements, with prompt injection acting as the delivery mechanism. Against PostgreSQL, the attacker reaches operating system command execution through COPY FROM PROGRAM, which runs shell commands as the database user.

Root Cause

The root cause is a trust boundary failure across two layers. User input is concatenated into LLM prompts without escaping, and LLM-generated SQL is executed without an allowlist, parser-level validation, or read-only enforcement. The system treats LLM output as trusted code.

Attack Vector

The attack requires network access and authenticated low-privilege access to the SQLBot chat interface. The attacker sends a crafted natural language question instructing the model to emit a specific SQL payload. On PostgreSQL backends, the payload uses COPY FROM PROGRAM '<command>' to execute arbitrary commands on the database host. The vulnerability mechanism is described in the GitHub Security Advisory.

Detection Methods for CVE-2026-33324

Indicators of Compromise

• PostgreSQL query logs containing COPY FROM PROGRAM or COPY TO PROGRAM statements originating from the SQLBot service account
• SQLBot application logs showing chat questions with embedded SQL keywords such as DROP, CREATE, COPY, or instructions like "ignore previous"
• Unexpected child processes spawned by the PostgreSQL server process (postgres)
• Outbound network connections from the database host to attacker-controlled infrastructure

Detection Strategies

• Inspect SQLBot request bodies for prompt-injection markers: instruction overrides, role-switch phrases, and inline SQL fragments in the question field
• Enable PostgreSQL log_statement = 'all' and alert on any COPY ... PROGRAM execution
• Monitor for process lineage where postgres spawns shells, interpreters, or networking utilities
• Correlate authenticated SQLBot session activity with anomalous SQL patterns and database host process events

Monitoring Recommendations

• Forward SQLBot, PostgreSQL, and host process telemetry to a centralized analytics platform for cross-source correlation
• Baseline normal Text2SQL query shapes and alert on outliers containing DDL, file I/O, or PROGRAM clauses
• Track failed and successful authentications to SQLBot to identify credential abuse preceding injection attempts

How to Mitigate CVE-2026-33324

Immediate Actions Required

• Upgrade SQLBot to version 1.7.1 or later without delay
• Rotate any credentials, API keys, or secrets accessible from the database host if exploitation is suspected
• Review PostgreSQL query history for COPY FROM PROGRAM usage tied to the SQLBot service account
• Restrict SQLBot authentication to trusted users and enforce strong access controls on the chat endpoint

Patch Information

The maintainers fixed CVE-2026-33324 in SQLBot version 1.7.1. Details are published in the GitHub Security Advisory GHSA-q2q6-gqqh-4xrx. Operators should upgrade rather than rely on workarounds.

Workarounds

• Configure the PostgreSQL connection used by SQLBot with a least-privilege, read-only role that cannot execute COPY ... PROGRAM
• Disable or block superuser privileges for the SQLBot database account, since COPY FROM PROGRAM requires elevated rights or membership in pg_execute_server_program
• Place the SQLBot interface behind network controls and require multi-factor authentication to limit attacker access
• Add an egress firewall policy on the database host to block unexpected outbound connections

# Configuration example: restrict the SQLBot PostgreSQL role
REVOKE pg_execute_server_program FROM sqlbot_user;
ALTER ROLE sqlbot_user NOSUPERUSER;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO sqlbot_user;