---
id: "CVE-2026-124850"
page: "https://infrastack.ai/live/CVE-2026-124850"
kind: "vulnerability"
aliases: ["CVE-2026-124850"]
title: "flowintel: migration script SQL injection via stored connector identifiers"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["database", "flowintel", "other", "self-hosted"]
not_affected_if: ["no-database-write-access", "version-4.0.0-or-later"]
published_at: "2026-11-09T15:17:19+00:00"
first_seen_at: "2026-11-09T15:27:06+00:00"
updated_at: "2026-11-09T15:28:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124850", "first_seen_at": "2026-11-09T15:27:06+00:00"}]
exploit_sources: []
---

# flowintel: migration script SQL injection via stored connector identifiers

Link for people: https://infrastack.ai/live/CVE-2026-124850 (this .md is for agents)

Flowintel's database migration script builds SQL statements by inserting stored connector identifier values without parameterization. An attacker who can already write to the database can run arbitrary SQL when a migration runs during an upgrade, exposing, changing or deleting data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed flowintel version; versions before `4.0.0` are listed as affected.
- Confirm whether untrusted users or processes can write to the flowintel database tables that store connector identifiers.

## Fix

- flowintel `4.0.0` (fixed release per the affected range: prior to 4.0.0)

## Timeline

- 2026-11-09T15:27:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124850

## Documents

- [fix] Patch: github.com https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d

## From the sources

A SQL injection vulnerability exists in a database migration script in flowintel.

The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.

- Requires prior write access to the database to plant a malicious identifier value
- Triggered automatically during a migration or upgrade operation
- Can result in unauthorized data disclosure, modification, or deletion

Affected versions: flowintel prior to 4.0.0

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_