Missing authentication in Aix-DB
CVE-2026-8335

7.1HIGH

Key Information:

Vendor

Aix-db

Status
Aix-db
Vendor
CVE Published:
10 June 2026

What is CVE-2026-8335?

A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.

Affected Version(s)

Aix-DB 0 <= 1.2.4

References

https://github.com/apconw/Aix-DB
product
https://cert.pl/posts/2026/06/CVE-2026-8335
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eryk Winiarz
.