CVE-2026-84061: zhongyu09 OpenChatBI SQL Injection Flaw

CVE-2026-84061 Overview

CVE-2026-84061 is a SQL injection vulnerability in zhongyu09 OpenChatBI up to version 0.3.0. The flaw resides in the _validate_sql_safety function within openchatbi/text2sql/generate_sql.py. An attacker with low-level privileges can manipulate SQL input remotely to bypass safety validation and execute unauthorized database operations. Versions v0.2.0 through v0.2.2 contain no SQL safety validation at all. Version v0.3.0 introduced a validator, and v1.0.0b1/main retained the same incomplete implementation with an optional stricter mode. The vendor was contacted about this disclosure but did not respond. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote attackers with authenticated access can inject arbitrary SQL statements through the text-to-SQL pipeline, compromising database confidentiality, integrity, and availability.

Affected Products

zhongyu09 OpenChatBI v0.2.0 through v0.2.2 (no SQL safety validation)
zhongyu09 OpenChatBI v0.3.0 (incomplete validator introduced)
zhongyu09 OpenChatBI v1.0.0b1 and main branch (same incomplete validator with optional stricter mode)

Discovery Timeline

2026-09-01 - CVE CVE-2026-84061 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84061

Vulnerability Analysis

OpenChatBI is a text-to-SQL business intelligence tool that translates natural language prompts into executable SQL queries. The _validate_sql_safety function in openchatbi/text2sql/generate_sql.py is responsible for screening generated SQL statements before execution. The validator fails to comprehensively neutralize dangerous SQL constructs, allowing crafted inputs to reach the database layer intact. Attackers can exploit this gap to inject arbitrary SQL, retrieve unauthorized data, alter records, or disrupt database operations.

Root Cause

The root cause is improper output neutralization [CWE-74]. Versions v0.2.0 through v0.2.2 shipped without any SQL safety validation. Version v0.3.0 added _validate_sql_safety, but the validation logic remains incomplete. Later releases including v1.0.0b1 preserved the same flawed validator and added an optional stricter mode that is not enforced by default.

Attack Vector

Exploitation requires network access and a low-privilege authenticated session against the OpenChatBI application. The attacker submits malicious natural-language or query input that, once translated, includes SQL fragments the validator fails to reject. The application executes the injected statement against the backing database. No user interaction beyond the authenticated session is required.

Refer to the VulDB entry for CVE-2026-84061 for additional technical details. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2026-84061

Indicators of Compromise

Unexpected SQL statements in database query logs originating from OpenChatBI service accounts, particularly containing stacked queries, UNION SELECT, or comment sequences.
Application logs from openchatbi/text2sql/generate_sql.py showing queries that pass _validate_sql_safety yet contain suspicious tokens.
Anomalous outbound data transfers or bulk record reads correlated with OpenChatBI sessions.

Detection Strategies

Enable query logging on the database backend and alert on statements from OpenChatBI that touch system tables, INFORMATION_SCHEMA, or perform DDL/DML outside expected schemas.
Deploy a web application firewall (WAF) in front of OpenChatBI with SQL injection signatures tuned for text-to-SQL payloads.
Correlate authenticated user sessions with generated SQL to identify users producing atypical query patterns.

Monitoring Recommendations

Monitor the OpenChatBI process for spawned database connections that deviate from baseline query complexity or duration.
Track failed and succeeded validator outcomes to identify probing behavior against _validate_sql_safety.
Audit database service account activity for privilege use inconsistent with reporting workloads.

How to Mitigate CVE-2026-84061

Immediate Actions Required

Restrict OpenChatBI database service accounts to least-privilege, read-only roles scoped to required schemas.
Enable the optional stricter validation mode available in v1.0.0b1 and main branch deployments.
Place OpenChatBI behind an authenticated reverse proxy and a WAF configured to block SQL injection patterns.

Patch Information

The vendor has not responded to disclosure, and no official patch has been published as of the NVD entry dated 2026-09-01. Track the VulDB vulnerability record #397552 and the upstream repository for fix availability.

Workarounds

Deploy OpenChatBI against a dedicated database instance with no sensitive data until a fix is released.
Enforce parameterized query execution at the database proxy layer to reject dynamic statements containing multiple query separators.
Disable or gate OpenChatBI access to trusted administrators only while the incomplete validator remains in place.

bash

# Example: enforce read-only least-privilege role for OpenChatBI DB user (PostgreSQL)
REVOKE ALL ON SCHEMA public FROM openchatbi_user;
GRANT USAGE ON SCHEMA analytics TO openchatbi_user;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO openchatbi_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA analytics
  GRANT SELECT ON TABLES TO openchatbi_user;