CVE-2026-8335

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8335

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8335.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8335

Published

2026-06-10T14:31:10.402Z

Modified

2026-07-15T01:49:19.902882324Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Missing authentication in Aix-DB

Details

A missing authentication check on the Aix‑DB "/llm/processllmout" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.

Database specific

{
    "cwe_ids": [
        "CWE-306"
    ],
    "cna_assigner": "CERT-PL",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8335.json"
}

References

Affected packages

Git / github.com/apconw/aix-db

Affected ranges

Type

GIT

Repo

https://github.com/apconw/aix-db

Events

Introduced

Last affected

5d370adf3e695fc8b11137e5beeb01973cb46810

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.2.4"
        }
    ]
}

Affected versions

v1.*

v1.2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8335.json"