CVE-2026-129127 · Other
NO FIX YET
SQLBot through version 1.10.3 stores local account passwords in its user table as unsalted MD5 digests. An attacker who gets a copy of that table can recover passwords, including administrator passwords, with precomputed tables or GPU cracking.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
SQLBot installations running version 1.10.3 or earlier that store local user accounts in the sys_user table. Anyone who can read that table, through a database leak or a compromised backup, is in a position to recover passwords. Deployments that use only external identity providers and do not store local passwords are unknown from the sources.
Not affected if external-auth-only
Who cares database, self-hosted, sqlbot
1.10.3 are described as affected.sys_user table's password column; unsalted 32-character hex values indicate MD5 hashing.No fix yet, per the sources.
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.