CVE-2026-124850
Received Received - Intake

SQL Injection in Flowintel Database Migration Script

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: CIRCL

Description
A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade. - Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion Affected versions: flowintel prior to 4.0.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-124850
EUVD
EUVD-2026-120079

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flowintel flowintel From 0 (inc) to 4.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in flowintel's database migration scripts. It occurs because the migration process directly inserts stored connector identifier values into SQL statements without using parameterization. An attacker with prior database write access can plant a malicious identifier that executes arbitrary SQL when the migration runs during an upgrade.

Detection Guidance

Detecting this vulnerability requires checking for malicious identifiers in the database tables used by flowintel. Review stored connector identifiers in the relevant tables for unusual or unexpected values. Look for identifiers containing SQL syntax or commands that could indicate exploitation. No specific commands are provided in the context.

Impact Analysis

If you use flowintel versions prior to 4.0.0, an attacker with database access could exploit this to execute unauthorized SQL commands. This may lead to data theft, modification, or deletion. The attack requires prior database access but is triggered automatically during upgrades.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is exposed or altered through SQL injection.

Mitigation Strategies
  • Upgrade flowintel to version 4.0.0 or later to apply the security fix that uses parameterized queries.
  • Review database tables for malicious connector identifiers and remove any suspicious values.
  • Ensure database access controls are in place to prevent unauthorized write access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...