Live › vulnerability › CVE-2026-112005
Go to dashboardWhoDB (database admin web UI) lets an unauthenticated user open a DuckDB session and then run SQL (read_text, read_blob, COPY TO, ATTACH) in the query editor. That reads any file the WhoDB process can read and writes files anywhere it can write. The attacker can read /data/session.key and whodb.db, then decrypt every logged-in user's stored database credentials offline. WhoDB CE has no user accounts and listens on all interfaces by default. A full public PoC is in the vendor advisory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| whodb | go | >= 0.104.0, < 0.135.0 | 0.135.0 |
{{.Config.Image}} <container>, or check the image tag; any WhoDB 0.104.0 to 0.134.x is vulnerable/data/session.key); only on your own instance0.135.0 or later (docker pull clidey/whodb:0.135.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
This page as .md · .json · in your agent: get_signal("CVE-2026-112005")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.