CVE-2026-86123: SQL Chat Unauthenticated SQLI Vulnerability

CVE-2026-86123 Overview

SQL Chat exposes four unauthenticated API endpoints under /src/pages/api/connection/ that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Because no authentication or host validation gates these endpoints, remote attackers can weaponize the SQL Chat server as a database connection proxy. Attackers reach internal databases, run arbitrary SQL, enumerate schemas, and pivot into the server-side network. The flaw is classified as Server-Side Request Forgery [CWE-918]. VulnCheck published the advisory describing the connection proxy behavior in the execute.ts and test.ts handlers.

Critical Impact
Unauthenticated remote attackers can use the SQL Chat host to reach internal databases, execute arbitrary SQL, and pivot into otherwise unreachable network segments.

Affected Products

SQL Chat (open-source AI SQL client maintained at sqlchat/sqlchat)
API connection endpoints in src/pages/api/connection/ (including execute.ts and test.ts)
Deployments exposing the SQL Chat web API to untrusted networks

Discovery Timeline

2026-09-05 - CVE-2026-86123 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86123

Vulnerability Analysis

SQL Chat is a Next.js application that provides a browser-based SQL client backed by server-side API routes. The routes under src/pages/api/connection/ accept a JSON body containing database driver, host, port, username, password, and query fields. The server opens the connection and forwards the SQL to whatever host the client specifies. There is no authentication requirement on these routes and no allow-list restricting the destination host. An unauthenticated HTTP client can therefore instruct the SQL Chat server to open outbound database connections on the attacker's behalf. This behavior converts the SQL Chat instance into an unauthenticated database proxy usable against any host the server can route to, including RFC1918 addresses, cloud metadata-adjacent services, and cluster-internal databases.

Root Cause

The root cause is missing access control combined with unrestricted outbound request generation, the defining pattern of Server-Side Request Forgery [CWE-918]. The execute and test handlers treat inbound connection parameters as trusted inputs and pass them directly to database driver libraries. See the referenced execute handler and test handler for the vulnerable code paths.

Attack Vector

Exploitation requires only network reachability to the SQL Chat API. An attacker sends a crafted POST request to one of the four connection endpoints with host, port, username, password, and query fields pointing at an internal database. The SQL Chat server establishes the connection, executes the query, and returns the result set. Attackers use this primitive to fingerprint internal services, brute force database credentials, exfiltrate data, and enumerate schemas. Refer to the VulnCheck advisory and GitHub Issue #189 for reproduction details.

Detection Methods for CVE-2026-86123

Indicators of Compromise

Unauthenticated POST requests to /api/connection/execute, /api/connection/test, or sibling routes from unexpected source addresses.
Outbound database connections (TCP 3306, 5432, 1433, 27017) originating from the SQL Chat server to internal hosts that the application does not normally query.
Request bodies containing host fields pointing to RFC1918 ranges, loopback, or cloud-internal DNS names.
Bursts of failed authentication events on internal databases sourced from the SQL Chat server IP.

Detection Strategies

Deploy a reverse-proxy or WAF rule that requires authentication on /api/connection/* and logs every request body for review.
Correlate SQL Chat access logs with egress netflow to identify database sessions initiated by external HTTP callers.
Alert on any new database destination reached by the SQL Chat host that is not on an explicit allow-list.

Monitoring Recommendations

Forward SQL Chat application logs and host netflow into a central analytics platform for correlation.
Baseline the set of database hosts the SQL Chat server normally contacts and alert on deviations.
Monitor internal databases for authentication attempts originating from application servers that should not hold those credentials.

How to Mitigate CVE-2026-86123

Immediate Actions Required

Remove SQL Chat from any network segment reachable by untrusted clients until access control is added in front of the API.
Place SQL Chat behind an authenticating reverse proxy (SSO, mTLS, or basic auth at minimum) that gates /api/connection/*.
Restrict egress from the SQL Chat host with firewall rules that only permit connections to sanctioned database endpoints.
Rotate any database credentials that may have been reachable from an internet-exposed SQL Chat instance.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the upstream sqlchat/sqlchat repository and GitHub Issue #189 for fix status. Until a fix ships, treat every SQL Chat deployment as an unauthenticated SSRF primitive and enforce compensating controls at the network layer.

Workarounds

Terminate the SQL Chat API behind an authenticating reverse proxy such as oauth2-proxy or an ingress controller enforcing OIDC.
Enforce an egress allow-list on the SQL Chat host limited to the specific database hosts and ports required.
Deploy the service inside a dedicated network segment with no route to production databases or cloud metadata services.
Remove or block the /api/connection/execute and /api/connection/test routes at the proxy layer if the connection UI is not required.

bash

# Example NGINX snippet requiring auth on connection endpoints
location /api/connection/ {
    auth_request /_oauth2_auth;
    proxy_pass http://sqlchat_upstream;
}