{"id":"CVE-2026-124850","kind":"vulnerability","aliases":["CVE-2026-124850"],"related":[],"title":"flowintel: migration script SQL injection via stored connector identifiers","description":"A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0","summary":"Flowintel's database migration script builds SQL statements by inserting stored connector identifier values without parameterization. An attacker who can already write to the database can run arbitrary SQL when a migration runs during an upgrade, exposing, changing or deleting data.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","flowintel","other","self-hosted"],"not_affected_if":["no-database-write-access","version-4.0.0-or-later"],"how_to_check":"- Check the installed flowintel version; versions before `4.0.0` are listed as affected.\n- Confirm whether untrusted users or processes can write to the flowintel database tables that store connector identifiers.","fix":"- flowintel `4.0.0` (fixed release per the affected range: prior to 4.0.0)","status":"open","published_at":"2026-11-09T15:17:19+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","triaged_at":"2026-11-09T15:28:05+00:00","updated_at":"2026-11-09T15:28:05+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T15:28:05Z","model":"claude-haiku-5-5","output":{"fix":"- flowintel `4.0.0` (fixed release per the affected range: prior to 4.0.0)","reach":"local","title":"flowintel: migration script SQL injection via stored connector identifiers","impact":"high","summary":"Flowintel's database migration script builds SQL statements by inserting stored connector identifier values without parameterization. An attacker who can already write to the database can run arbitrary SQL when a migration runs during an upgrade, exposing, changing or deleting data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["flowintel","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"arbitrary SQL runs on the database, exposing or altering data","analyst_note":"","how_to_check":"- Check the installed flowintel version; versions before `4.0.0` are listed as affected.\n- Confirm whether untrusted users or processes can write to the flowintel database tables that store connector identifiers.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.0.0-or-later","no-database-write-access"],"who_is_affected":"Teams that run flowintel before version 4.0.0 and run its database migrations during upgrades. Exposure requires an attacker who already has write access to the database to plant a malicious connector identifier, so instances where only trusted administrators can write to the database carry less risk. Installs already on 4.0.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4653,"output_tokens":541,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124850':12A,15A '-2026':11A,14A '4.0.0':159C 'access':127C 'affect':107C,154C 'alreadi':42B 'applic':122C 'arbitrari':49B,111C 'attack':39B,96C 'automat':138C 'build':27B 'caus':110C 'chang':59B 'connector':8A,33B,80C 'cve':10A,13A 'data':62B,149C 'databas':16B,24B,46B,70C,85C,130C 'delet':61B,153C 'direct':89C 'disclosur':150C 'execut':113C 'exist':67C 'expos':58B 'flowintel':1A,17B,22B,74C,156C 'host':21B 'identifi':9A,34B,81C,103C,135C 'inject':5A,65C 'insert':31B 'interpol':87C 'malici':102C,134C 'migrat':2A,25B,53B,71C,76C,116C,141C 'modif':151C 'oper':144C 'parameter':37B,94C 'plant':132C 'previous':99C 'prior':125C,157C 'process':77C 'read':78C 'requir':124C 'result':146C 'run':48B,54B,119C 'script':3A,26B,72C 'self':20B 'self-host':19B 'sql':4A,28B,50B,64C,91C,112C 'statement':29B,92C 'store':7A,32B,79C 'subsequ':118C 'tabl':108C 'trigger':137C 'unauthor':148C 'upgrad':57B,123C,143C 'valu':35B,82C,104C,136C 'version':155C 'via':6A 'vulner':66C 'without':36B,93C 'write':43B,126C 'written':100C","nicknames":[],"mitigations":[],"who_affected":"Teams that run flowintel before version 4.0.0 and run its database migrations during upgrades. Exposure requires an attacker who already has write access to the database to plant a malicious connector identifier, so instances where only trusted administrators can write to the database carry less risk. Installs already on 4.0.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","flowintel","high","other","selfhosted"],"campaign_type":null,"search_a":"'-124850':12A,15A '-2026':11A,14A 'connector':8A 'cve':10A,13A 'flowintel':1A 'identifi':9A 'inject':5A 'migrat':2A 'script':3A 'sql':4A 'store':7A 'via':6A","search_b":"'alreadi':42B 'arbitrari':49B 'attack':39B 'build':27B 'chang':59B 'connector':33B 'data':62B 'databas':16B,24B,46B 'delet':61B 'expos':58B 'flowintel':17B,22B 'host':21B 'identifi':34B 'insert':31B 'migrat':25B,53B 'parameter':37B 'run':48B,54B 'script':26B 'self':20B 'self-host':19B 'sql':28B,50B 'statement':29B 'store':32B 'upgrad':57B 'valu':35B 'without':36B 'write':43B","search_c":"'4.0.0':159C 'access':127C 'affect':107C,154C 'applic':122C 'arbitrari':111C 'attack':96C 'automat':138C 'caus':110C 'connector':80C 'data':149C 'databas':70C,85C,130C 'delet':153C 'direct':89C 'disclosur':150C 'execut':113C 'exist':67C 'flowintel':74C,156C 'identifi':81C,103C,135C 'inject':65C 'interpol':87C 'malici':102C,134C 'migrat':71C,76C,116C,141C 'modif':151C 'oper':144C 'parameter':94C 'plant':132C 'previous':99C 'prior':125C,157C 'process':77C 'read':78C 'requir':124C 'result':146C 'run':119C 'script':72C 'sql':64C,91C,112C 'statement':92C 'store':79C 'subsequ':118C 'tabl':108C 'trigger':137C 'unauthor':148C 'upgrad':123C,143C 'valu':82C,104C,136C 'version':155C 'vulner':66C 'without':93C 'write':126C 'written':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124850","severity":null,"published_at":"2026-11-09T15:17:19+00:00","modified_at":"2026-11-09T15:17:19+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","fetched_at":"2026-11-09T15:27:06+00:00","note":null}],"documents":[{"id":108023,"url":"https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}