CVE-2026-86123: Sqlchat

High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days.

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication.

Affected products

• Sqlchat Sqlchat

Published 2026-09-05. Last modified 2026-09-24.