CVE-2026-124850 · Other
NO FIX YET · SEE WHAT TO DO
Flowintel's database migration script builds SQL statements by inserting stored connector identifier values without parameterization. An attacker who can already write to the database can run arbitrary SQL when a migration runs during an upgrade, exposing, changing or deleting data.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run flowintel before version 4.0.0 and run its database migrations during upgrades. Exposure requires an attacker who already has write access to the database to plant a malicious connector identifier, so instances where only trusted administrators can write to the database carry less risk. Installs already on 4.0.0 or later are not affected.
Not affected if no-database-write-access, version-4.0.0-or-later
Who cares database, flowintel, self-hosted
4.0.0 are listed as affected.4.0.0 (fixed release per the affected range: prior to 4.0.0)A SQL injection vulnerability exists in a database migration script in flowintel.
The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.
Affected versions: flowintel prior to 4.0.0
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.