CVE-2026-54629

Received Received - Intake

Unauthenticated File Read via SQLite Virtual Tables in Anyquery

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can use SQLite CREATE VIRTUAL TABLE statements to provide a local path to these modules, which use hashicorp/go-getter under the Anyquery server process and return the selected file contents as queryable table rows. The disclosure is limited only by the filesystem permissions of the server process and can expose system configuration, credentials, and private keys. This issue is fixed in version 0.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-54629

Affected Vendors & Products

Vendor	Product	Version / Range
anyquery	anyquery	0.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-54629 is a Local File Read vulnerability in Anyquery's server mode. It affects versions up to 0.4.4 and allows unauthenticated attackers to connect to the MySQL-compatible server port and create virtual tables pointing to arbitrary local files. This grants full read access to sensitive system files like /etc/passwd or ~/.ssh/id_rsa, compromising confidentiality.

Detection Guidance

Check if Anyquery server is running on your system, particularly versions before 0.4.5. Look for open MySQL-compatible ports (default 3306 or custom) and test if unauthenticated connections can execute SQLite CREATE VIRTUAL TABLE statements. Use commands like 'netstat -tulnp | grep 3306' to check for open ports and 'nc <server_ip> 3306' to attempt a connection.

Impact Analysis

An attacker can exploit this to read sensitive files on the server, including system configuration, credentials, and private keys. This could lead to further attacks like privilege escalation, data theft, or unauthorized access to other systems if credentials are exposed.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade Anyquery to version 0.4.5 or later immediately. If upgrading is not possible, restrict access to the MySQL-compatible server port using firewalls or network policies. Implement sandboxing with the --restrict-paths flag to limit file access. Disable the server if not needed.

Hi! I’m here to help you understand CVE-2026-54629. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70