CVE-2026-129127

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-129127
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129127.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-129127
Published
2026-11-13T16:23:41Z
Modified
2026-11-14T02:47:33Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5
Details

SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-916"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129127.json"
}
References

Affected packages

Git / github.com/dataease/sqlbot

Affected ranges

Type
GIT
Repo
https://github.com/dataease/sqlbot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
96f06c7eade60ecf3e6af0313821373761d1fb85
Fixed
8b4097f216d0d57e7c82f12ef6b36add1f64e49e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "1.10.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "8b4097f216d0d57e7c82f12ef6b36add1f64e49e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.1.2
v1.1.3
v1.1.4
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129127.json"