CVE-2026-8335
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A missing authentication check on the Aix-DB '/llm/process_llm_out' endpoint allows unauthenticated clients to execute arbitrary 'SELECT' SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints.
Risk Assessment
The organization is exposed to unauthorized access to database data, which may lead to information leakage and violation of user privacy.
Recommendation
It is recommended to implement appropriate authentication mechanisms for the '/llm/process_llm_out' endpoint and to update to the latest software version as soon as a patch becomes available.
Other vulnerabilities in Aix-DB
See all- CVE-2026-77926High
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
- CVE-2026-82881Medium
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.
Original NVD description (English source)
A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS