CVE-2026-54629
HighCVSS 7.5Summary
Anyquery before 0.4.5 exposes file-backed SQLite virtual table modules (csv_reader, log_reader) through its MySQL-compatible server port without authentication, allowing a remote attacker to read arbitrary files from the system.
Risk Assessment
An attacker can access system files, credentials, and private keys, leading to full compromise of data confidentiality.
Recommendation
Update Anyquery to version 0.4.5 or later, which adds authentication and access restrictions to the modules.
Other vulnerabilities in Anyquery
See all- CVE-2026-54628High
Anyquery prior to 0.4.5 exposes URL-capable SQLite virtual table modules (json_reader, log_reader) through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can supply a loopback, private-network, or link-local URL (e.g. cloud metadata), causing go-getter to fetch the resource and expose the response as queryable table data.
- CVE-2026-47253High
In Anyquery prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke it via the /v1/query HTTP endpoint, causing recursive deletion of any directory writable by the Anyquery server process.
- CVE-2026-50006Critical
Anyquery prior to 0.4.5 forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.
Original NVD description (English source)
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can use SQLite CREATE VIRTUAL TABLE statements to provide a local path to these modules, which use hashicorp/go-getter under the Anyquery server process and return the selected file contents as queryable table rows. The disclosure is limited only by the filesystem permissions of the server process and can expose system configuration, credentials, and private keys. This issue is fixed in version 0.4.5.