CVE-2026-124850

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124850", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-11-09T14:38:45.169Z", "datePublished": "2026-11-09T14:43:27.959Z", "dateUpdated": "2026-11-12T16:24:54.028Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-11-09T14:43:27.959Z"}, "title": "SQL Injection in Database Migration via Stored Connector Identifiers in flowintel", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "affected": [{"vendor": "flowintel", "product": "flowintel", "cpes": ["cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*"], "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "4.0.0"}], "modules": ["migrations"], "programFiles": ["migrations/versions/5cd03995339b_.py"], "repo": "https://github.com/flowintel/flowintel"}], "descriptions": [{"lang": "en", "value": "A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0"}], "solutions": [{"lang": "en", "value": "The vulnerability is remediated by replacing direct string interpolation of stored database values into SQL queries with parameterized (bound) queries, ensuring that user-supplied or stored data is treated strictly as data rather than executable SQL. Additionally, the NULL handling for identifier fields is corrected to use proper SQL NULL instead of the string literal 'null', preventing both injection and unintended data corruption."}], "references": [{"url": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d", "name": "Security patch", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}, {"format": "SSVC", "scenarios": [{"lang": "en", "value": "GENERAL"}], "other": {"type": "SSVC", "content": {"version": "2.0.3", "role": "Supplier", "timestamp": "2026-11-09T14:12:17Z", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}]}}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*"}]}]}], "credits": [{"lang": "en", "value": "elhoim", "type": "reporter"}, {"lang": "en", "value": "David Cruciani", "type": "remediation developer"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 SQL Injection"}]}], "x_gcve": [{"vulnId": "gcve-1-2026-20156", "recordType": "advisory", "extensions": {"bcp-05-x-01": {"ai_annotations": [{"scope": "record", "gna_source": 1, "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"], "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "ai_level": "generated", "review_status": "full", "models": [{"name": "qwen3.8:27b", "gna_source": 1, "source": "ollama", "identifier": "qwen3.8:27b"}]}]}, "bcp-05-x-02": {"x_patch2vuln": {"generator": "patch2vuln.py", "generatedAt": "2026-11-09T14:12:17.714022Z", "model": "qwen3.8:27b", "source": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch", "patchSha256": "9ad956ded461ca4c442070a86c76b0239017eeb48e36892684465b9b6fb4ccde", "patchTruncated": false, "commit": "061053689dc279a3c2c182f8dc15cd42dc24bd7d", "subject": "fix: [security] Bind stored connector identifiers during", "patches": [{"source": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch", "sourceUrl": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch", "patchSha256": "9ad956ded461ca4c442070a86c76b0239017eeb48e36892684465b9b6fb4ccde", "commit": "061053689dc279a3c2c182f8dc15cd42dc24bd7d", "subject": "fix: [security] Bind stored connector identifiers during", "date": "Fri, 6 Nov 2026 10:54:39 +0100", "retrievedAt": "2026-11-09T14:10:44.764240Z"}], "confidence": "medium", "assumptions": ["The affected version range is inferred from the explicit context (affected_version '0', fixed_version '<=4.0.0'); the exact starting version is not confirmed by the patch itself.", "PR:L assumes the attacker can write to the database via an authenticated application role or direct DB access; the specific authentication mechanism is not stated in the patch.", "The CVSS impact ratings (VC:H, VI:H, VA:H) assume the database user has broad privileges; if the DB account is highly restricted, impact could be lower.", "CAPEC-126 is selected as the closest match; the stored/timed nature of the injection (data planted before migration runs) is a variant not explicitly covered by a more specific CAPEC.", "The patch does not indicate whether the migration has already been executed in deployed instances, which would affect real-world exploitability."], "fixSummary": "The vulnerability is remediated by replacing direct string interpolation of stored database values into SQL queries with parameterized (bound) queries, ensuring that user-supplied or stored data is treated strictly as data rather than executable SQL. Additionally, the NULL handling for identifier fields is corrected to use proper SQL NULL instead of the string literal 'null', preventing both injection and unintended data corruption.", "patchSummary": "In migrations/versions/5cd03995339b_.py, four SQL statements (two SELECT and two UPDATE) are converted from Python f-string interpolation to SQLAlchemy parameterized queries using named bind parameters (:case_id, :instance_id, :ident, :id, :task_id). The NULL identifier handling is changed from assigning the string 'null' to assigning Python None, which SQLAlchemy translates to a proper SQL NULL value.", "credits": [{"lang": "en", "value": "elhoim", "type": "reporter"}, {"lang": "en", "value": "David Cruciani", "type": "remediation developer"}], "cvssRationale": "AV:L: The migration runs locally on the application server; exploitation requires local access to the database. AC:H: High complexity because the attacker must first write a crafted identifier into the database and then wait for a migration to execute. AT:P: Attack targeting is present; the attacker must specifically craft a malicious SQL payload in the identifier field. PR:L: Low privilege; the attacker needs write access to the database (e.g., an authenticated application user or DB access). UI:N: The migration runs automatically during upgrade; no user interaction is required at trigger time. VC:H, VI:H, VA:H: Successful SQL injection allows arbitrary read, write, and destructive operations on the database. SC:N, SI:N, SA:N: Impact is confined to the local database; no evidence of cross-component or cross-system impact.", "ssvc": {"version": "2.0.3", "role": "Supplier", "timestamp": "2026-11-09T14:12:17Z", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}]}, "weaknessRationale": [{"cweId": "CWE-89", "rationale": "The patch directly replaces f-string interpolation of stored values into SQL with parameterized queries, which is the canonical fix for CWE-89. The commit message explicitly states that stored identifiers were 'interpolated into SQL, allowing expressions to execute,' confirming SQL injection."}], "capecRationale": [{"capecId": "CAPEC-126", "rationale": "The vulnerability is a textbook SQL injection: attacker-controlled data (stored connector identifiers) is concatenated into SQL statements without sanitization or parameterization. CAPEC-126 is the most direct and specific match. The stored nature of the injection (data planted earlier, executed later during migration) is a variant but still falls squarely within this pattern."}], "modelComparison": {"selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.", "rankings": [{"model": "qwen3.8:27b", "score": 7, "agreementScore": 11, "confidence": "medium", "assumptionCount": 5}], "potentialErrors": []}}}, "bcp-05-x-03": {"x_timeline": {"events": [{"type": "fix-developed", "timestamp": "2026-11-06T09:54:39Z", "description": "Corrective change authored (061053689dc279a3c2c182f8dc15cd42dc24bd7d): fix: [security] Bind stored connector identifiers during", "references": ["https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch"], "id": "evt-fix-developed-1"}, {"id": "evt-fix-available-1", "type": "fix-available", "timestamp": "2026-11-09T14:10:44.764240Z", "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.", "references": ["https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch"]}]}}}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T16:24:26.530803Z", "id": "CVE-2026-124850", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T16:24:54.028Z"}}]}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*"], "modules": ["migrations"], "product": "flowintel", "programFiles": ["migrations/versions/5cd03995339b_.py"], "repo": "https://github.com/flowintel/flowintel", "vendor": "flowintel", "versions": [{"lessThanOrEqual": "4.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0"}], "id": "CVE-2026-124850", "lastModified": "2026-11-12T20:07:11.090", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "Supplier", "timestamp": "2026-11-09T14:12:17Z", "version": "2.0.3"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-124850", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T16:24:26.530803Z", "version": "2.0.3"}}]}, "published": "2026-11-09T15:17:19.020", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.0.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "flowintel", "source": "cna", "vendor": "flowintel"}, "product": "flowintel", "vendor": "flowintel"}], "created": "2026-11-09T16:00:20.159200+00:00", "updated": "2026-11-09T16:35:15.668804+00:00", "vendors": ["flowintel", "flowintel$PRODUCT$flowintel"]}