SQL Injection Vulnerability in Flowintel Database Migration Script

CVE-2026-124850

What is CVE-2026-124850?

A SQL injection vulnerability exists within a database migration script in Flowintel, which is triggered during application upgrades. The issue arises because the migration process directly interpolates stored connector identifier values into SQL statements without proper parameterization. This flaw allows an attacker with prior write access to the database to insert a malicious identifier, leading to arbitrary SQL execution during migration. Consequently, this can result in unauthorized data disclosures, modifications, or deletions.

References