CVE-2026-54629: Anyquery SQL Engine Information Disclosure

CVE-2026-54629 Overview

CVE-2026-54629 is an arbitrary file read vulnerability in Anyquery, an SQL query engine built on top of SQLite. Prior to version 0.4.5, the Anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port. These modules are reachable without authentication, authorization, or directory restrictions. A remote attacker can issue CREATE VIRTUAL TABLE statements that supply arbitrary local file paths, then query the resulting rows to exfiltrate file contents. The disclosure boundary is limited only by the filesystem permissions of the server process. The flaw is classified as [CWE-22] Path Traversal.

Critical Impact
Unauthenticated remote attackers can read any file readable by the Anyquery server process, including system configuration, credentials, and private keys.

Affected Products

Anyquery server versions prior to 0.4.5
Deployments exposing the MySQL-compatible server port to untrusted networks
Any environment where the server process has access to sensitive files

Discovery Timeline

2026-09-14 - CVE-2026-54629 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-54629

Vulnerability Analysis

Anyquery exposes SQLite virtual table modules through a MySQL wire-protocol listener. Modules such as csv_reader and log_reader accept a file path parameter and return file contents as SQL-queryable rows. In versions prior to 0.4.5, the server enforces no authentication on this listener and applies no directory allow-list to path parameters. Attackers can reach the port over the network and register a virtual table pointing at any local file. Because the modules rely on hashicorp/go-getter beneath the server process, the read executes with the server's filesystem privileges. The result is direct disclosure of file contents through ordinary SELECT queries.

Root Cause

The root cause is missing access control on file-backed virtual table modules exposed through the network interface. The server treats remote MySQL clients as trusted local users and passes user-supplied paths to file readers without validation. There is no sandbox, no path canonicalization check, and no restriction on which directories the reader modules may traverse.

Attack Vector

Exploitation requires network reachability to the Anyquery MySQL-compatible port. An attacker connects with any MySQL client, issues CREATE VIRTUAL TABLE ... USING csv_reader('/path/to/target'), and then runs SELECT * FROM ... to retrieve the file contents. Typical targets include /etc/passwd, /etc/shadow, SSH private keys under ~/.ssh/, cloud credential files, and application configuration containing database passwords or API tokens.

// Security patch in cmd/helper.go - adds sandboxing flags
func addFlag_commandCanBeInteractive(cmd *cobra.Command) {
	cmd.Flags().Bool("no-input", false, "Do not ask for input")
}

// addSandboxFlags registers the sandboxing flags.
//
// For the server, sandboxing is on by default and --no-sandbox disables it; for
// CLI commands, --sandbox opts in (off by default, since local use is trusted).
// The relaxation flags are identical in both cases.
func addSandboxFlags(cmd *cobra.Command, isServer bool) {
	cmd.Flags().StringSlice("allow-dirs", []string{}, "When sandboxed, directories that read_* tables (and on-disk ATTACH) may access (repeatable, comma-separated)")
	cmd.Flags().Bool("allow-remote", false, "When sandboxed, allow read_* tables to fetch remote URLs (http/https/s3/...)")
	cmd.Flags().Bool("allow-attach", false, "When sandboxed, allow ATTACH/VACUUM INTO to on-disk paths within --allow-dirs")
	cmd.Flags().Bool("allow-db-connections", false, "When sandboxed, allow the database reader modules (duckdb/postgres/mysql/clickhouse/cassandra)")
	if isServer {
		cmd.Flags().Bool("no-sandbox", false, "Disable server sandboxing entirely (UNSAFE: exposes local file read, SSRF, and arbitrary file write)")
	} else {
		cmd.Flags().Bool("sandbox", false, "Apply server-style sandboxing restrictions (off by default in CLI mode)")
	}
}

Source: GitHub Commit 27f84fc

Detection Methods for CVE-2026-54629

Indicators of Compromise

Unexpected inbound connections to the Anyquery MySQL-compatible server port from unknown clients.
Server logs showing CREATE VIRTUAL TABLE statements that reference csv_reader, log_reader, or other read_* modules with absolute filesystem paths.
SELECT queries targeting virtual tables backed by sensitive paths such as /etc/, ~/.ssh/, or cloud credential directories.
Process-level file access by the Anyquery binary to files outside its normal working directory.

Detection Strategies

Enable and review Anyquery server query logging for CREATE VIRTUAL TABLE statements referencing file-backed modules.
Correlate network flow data with process telemetry to identify remote clients driving local file reads.
Alert on Anyquery process reads of high-value files such as /etc/shadow, private key files, and cloud provider credential stores.

Monitoring Recommendations

Monitor the Anyquery listening port for exposure beyond intended management networks.
Track the installed Anyquery version across hosts and flag any instance below 0.4.5.
Audit command-line invocations of anyquery server for the absence of --allow-dirs or presence of --no-sandbox.

How to Mitigate CVE-2026-54629

Immediate Actions Required

Upgrade Anyquery to version 0.4.5 or later on every host running the server component.
Restrict network access to the Anyquery MySQL-compatible port using firewall rules or bind it to 127.0.0.1.
Run the Anyquery server under a dedicated low-privilege account with no access to sensitive files.
Rotate any credentials, private keys, or tokens that were accessible to the server process before patching.

Patch Information

The fix ships in Anyquery 0.4.5. The patch introduces sandboxing that is enabled by default for the server, along with --allow-dirs, --allow-remote, --allow-attach, and --allow-db-connections flags to explicitly opt in to previously implicit behavior. See the GitHub Security Advisory GHSA-mf78-3rpf-r784 and the Anyquery 0.4.5 release notes.

Workarounds

Block inbound access to the Anyquery server port from untrusted networks until the upgrade is applied.
Stop the Anyquery server process on any host where it is not actively required.
Where upgrade is possible but full lockdown is not, launch the server with --allow-dirs limited to specific safe directories and avoid --no-sandbox.

bash

# Start Anyquery server 0.4.5+ with sandboxing and a restricted allow-list
anyquery server \
  --host 127.0.0.1 \
  --allow-dirs /var/lib/anyquery/data

# Verify version is 0.4.5 or later
anyquery --version