{"id":"CVE-2026-129127","kind":"vulnerability","aliases":["CVE-2026-129127"],"related":[],"title":"SQLBot: local account passwords stored as unsalted MD5 hashes","description":"SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.","summary":"SQLBot through version 1.10.3 stores local account passwords in its user table as unsalted MD5 digests. An attacker who gets a copy of that table can recover passwords, including administrator passwords, with precomputed tables or GPU cracking.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","other","self-hosted","sqlbot"],"not_affected_if":["external-auth-only"],"how_to_check":"- Check the SQLBot version in use; versions up to and including `1.10.3` are described as affected.\n- Look at the `sys_user` table's password column; unsalted 32-character hex values indicate MD5 hashing.","fix":null,"status":"open","published_at":"2026-11-13T17:17:30+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","triaged_at":"2026-11-13T17:49:06+00:00","updated_at":"2026-11-13T17:49:06+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:49:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources do not state a fixed version. A patch link is listed as a linked post but its content was not provided.","reach":"unknown","title":"SQLBot: local account passwords stored as unsalted MD5 hashes","impact":"high","summary":"SQLBot through version 1.10.3 stores local account passwords in its user table as unsalted MD5 digests. An attacker who gets a copy of that table can recover passwords, including administrator passwords, with precomputed tables or GPU cracking.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sqlbot","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attackers recover administrator passwords from a stolen user table","analyst_note":"Confirm the fixed version and whether the patch link at github.com resolves this CVE; check the vulncheck advisory for the attack prerequisites.","how_to_check":"- Check the SQLBot version in use; versions up to and including `1.10.3` are described as affected.\n- Look at the `sys_user` table's password column; unsalted 32-character hex values indicate MD5 hashing.\n- unknown for a fixed version or a configuration check, since the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["external-auth-only"],"who_is_affected":"SQLBot installations running version 1.10.3 or earlier that store local user accounts in the sys_user table. Anyone who can read that table, through a database leak or a compromised backup, is in a position to recover passwords. Deployments that use only external identity providers and do not store local passwords are unknown from the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000767,"input_tokens":4607,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129127':12A,15A '-2026':11A,14A '1.10.3':25B,61C 'account':3A,28B,71C 'administr':51B,93C 'attack':39B,83C 'contain':62C 'copi':43B 'crack':58B,100C 'cve':10A,13A 'databas':16B 'digest':37B,78C 'get':41B 'gpu':57B,99C 'hash':9A,66C,106C 'host':20B 'ident':102C,105C 'includ':50B,92C 'local':2A,27B,70C 'md5':8A,36B,77C 'md5pwd':80C 'obtain':85C 'password':4A,29B,49B,52B,65C,72C,91C,94C,103C 'precomput':54B,96C 'produc':104C 'recov':48B,90C 'security.py':82C 'self':19B 'self-host':18B 'sinc':101C 'sqlbot':1A,21B,22B,59C 'store':5A,26B,69C 'sys_user.password':74C 'tabl':33B,46B,55B,88C,97C 'unsalt':7A,35B,76C 'use':95C 'user':32B,87C 'version':24B 'via':79C 'vulner':67C 'weak':64C","nicknames":[],"mitigations":[],"who_affected":"SQLBot installations running version 1.10.3 or earlier that store local user accounts in the sys_user table. Anyone who can read that table, through a database leak or a compromised backup, is in a position to recover passwords. Deployments that use only external identity providers and do not store local passwords are unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","other","selfhosted","sqlbot"],"campaign_type":null,"search_a":"'-129127':12A,15A '-2026':11A,14A 'account':3A 'cve':10A,13A 'hash':9A 'local':2A 'md5':8A 'password':4A 'sqlbot':1A 'store':5A 'unsalt':7A","search_b":"'1.10.3':25B 'account':28B 'administr':51B 'attack':39B 'copi':43B 'crack':58B 'databas':16B 'digest':37B 'get':41B 'gpu':57B 'host':20B 'includ':50B 'local':27B 'md5':36B 'password':29B,49B,52B 'precomput':54B 'recov':48B 'self':19B 'self-host':18B 'sqlbot':21B,22B 'store':26B 'tabl':33B,46B,55B 'unsalt':35B 'user':32B 'version':24B","search_c":"'1.10.3':61C 'account':71C 'administr':93C 'attack':83C 'contain':62C 'crack':100C 'digest':78C 'gpu':99C 'hash':66C,106C 'ident':102C,105C 'includ':92C 'local':70C 'md5':77C 'md5pwd':80C 'obtain':85C 'password':65C,72C,91C,94C,103C 'precomput':96C 'produc':104C 'recov':90C 'security.py':82C 'sinc':101C 'sqlbot':59C 'store':69C 'sys_user.password':74C 'tabl':88C,97C 'unsalt':76C 'use':95C 'user':87C 'via':79C 'vulner':67C 'weak':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129127","severity":null,"published_at":"2026-11-13T17:17:30+00:00","modified_at":"2026-11-13T17:17:30+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","fetched_at":"2026-11-13T17:48:01+00:00","note":null}],"documents":[{"id":148121,"url":"https://github.com/dataease/SQLBot/commit/8b4097f216d0d57e7c82f12ef6b36add1f64e49e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148122,"url":"https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-weak-password-hashing-via-unsalted-md5","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}