CVE-2026-54628: Anyquery SQL Engine Information Disclosure

CVE-2026-54628 Overview

Anyquery is an SQL query engine built on top of SQLite. Versions prior to 0.4.5 expose URL-capable SQLite virtual table modules such as json_reader and log_reader through the unauthenticated MySQL-compatible server port. The server does not restrict outbound destinations, enabling Server-Side Request Forgery (SSRF) [CWE-284]. A remote attacker can supply loopback, private-network, or link-local cloud metadata URLs. The go-getter component then fetches the resource and returns its contents as queryable table data. Attackers can probe internal networks, reach internal APIs, and disclose cloud credentials.

Critical Impact
Unauthenticated remote attackers can exfiltrate cloud instance metadata credentials and pivot into internal services through the Anyquery server.

Affected Products

Anyquery server versions prior to 0.4.5
Deployments exposing the MySQL-compatible server port
Instances running in cloud environments with metadata service endpoints

Discovery Timeline

2026-09-14 - CVE-2026-54628 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-54628

Vulnerability Analysis

Anyquery bundles SQLite virtual table modules that accept URL arguments, including json_reader and log_reader. When the Anyquery MySQL-compatible server listens on a network port, clients can issue SQL statements without authentication. Those statements can reference arbitrary URLs, which the server retrieves through the go-getter library.

The fetched response is exposed as queryable table rows. An attacker can therefore read the response body of any URL the server process can reach. This includes loopback services, private-network hosts, and cloud metadata endpoints such as 169.254.169.254.

Root Cause

The root cause is missing access control on outbound destinations [CWE-284]. The MySQL-compatible server accepts unauthenticated connections and forwards user-controlled URLs to go-getter without a scheme or destination allowlist. No sandbox separates the untrusted query surface from local and internal network resources.

Attack Vector

An attacker connects to the exposed MySQL-compatible port and issues a query that invokes a URL-capable virtual table. The server fetches the URL and returns the body as rows. Requesting cloud metadata URLs discloses temporary credentials. Requesting internal API endpoints enables reconnaissance and, where those APIs perform state-changing actions on GET, limited integrity impact.

// Patch: cmd/helper.go introduces sandboxing flags in v0.4.5
func addSandboxFlags(cmd *cobra.Command, isServer bool) {
	cmd.Flags().StringSlice("allow-dirs", []string{}, "When sandboxed, directories that read_* tables (and on-disk ATTACH) may access (repeatable, comma-separated)")
	cmd.Flags().Bool("allow-remote", false, "When sandboxed, allow read_* tables to fetch remote URLs (http/https/s3/...)")
	cmd.Flags().Bool("allow-attach", false, "When sandboxed, allow ATTACH/VACUUM INTO to on-disk paths within --allow-dirs")
	cmd.Flags().Bool("allow-db-connections", false, "When sandboxed, allow the database reader modules (duckdb/postgres/mysql/clickhouse/cassandra)")
	if isServer {
		cmd.Flags().Bool("no-sandbox", false, "Disable server sandboxing entirely (UNSAFE: exposes local file read, SSRF, and arbitrary file write)")
	} else {
		cmd.Flags().Bool("sandbox", false, "Apply server-style sandboxing restrictions (off by default in CLI mode)")
	}
}
// Source: https://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c

Detection Methods for CVE-2026-54628

Indicators of Compromise

Outbound HTTP requests from the Anyquery server process to 169.254.169.254, metadata.google.internal, or other cloud metadata endpoints.
MySQL protocol connections to the Anyquery listener from unexpected source addresses.
SQL queries referencing json_reader, log_reader, or other read_* virtual tables with URLs pointing at loopback or RFC1918 ranges.

Detection Strategies

Inspect Anyquery server logs for queries containing URL arguments to virtual table modules and correlate with the requesting client IP.
Monitor host and network telemetry for the Anyquery process making unusual outbound connections to internal addresses.
Alert on any MySQL-compatible session that succeeds without authentication credentials being presented.

Monitoring Recommendations

Deploy egress filtering rules that log or block requests from application hosts to cloud metadata IP addresses.
Capture MySQL protocol traffic to the Anyquery listener and retain query text for retrospective analysis.
Track process-level network activity for the Anyquery binary to baseline expected outbound destinations.

How to Mitigate CVE-2026-54628

Immediate Actions Required

Upgrade Anyquery to version 0.4.5, where server sandboxing is enabled by default.
Restrict network access to the MySQL-compatible server port using firewall or security group rules until patched.
Rotate any cloud credentials associated with metadata endpoints reachable from the Anyquery host.

Patch Information

The fix is available in GitHub Release v0.4.5. The patch introduces sandboxing that restricts read_* virtual table modules from fetching remote URLs unless --allow-remote is explicitly set. Additional context is available in GitHub Security Advisory GHSA-hwrq-8wxh-q4xv and the GitHub Commit Overview.

Workarounds

Bind the Anyquery MySQL-compatible listener to 127.0.0.1 instead of a public interface.
Place the server behind an authenticating proxy that terminates untrusted client traffic.
Apply host-level egress controls that block outbound requests to metadata and internal management endpoints.

bash

# Run Anyquery 0.4.5+ server with sandbox enabled (default) and no remote fetch
anyquery server --host 127.0.0.1 --port 8070

# Explicitly refuse to relax sandbox protections; do NOT pass --no-sandbox or --allow-remote in production