---
id: "CVE-2026-129127"
page: "https://infrastack.ai/live/CVE-2026-129127"
kind: "vulnerability"
aliases: ["CVE-2026-129127"]
title: "SQLBot: local account passwords stored as unsalted MD5 hashes"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["database", "other", "self-hosted", "sqlbot"]
not_affected_if: ["external-auth-only"]
published_at: "2026-11-13T17:17:30+00:00"
first_seen_at: "2026-11-13T17:48:01+00:00"
updated_at: "2026-11-13T17:49:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129127", "first_seen_at": "2026-11-13T17:48:01+00:00"}]
exploit_sources: []
---

# SQLBot: local account passwords stored as unsalted MD5 hashes

Link for people: https://infrastack.ai/live/CVE-2026-129127 (this .md is for agents)

SQLBot through version 1.10.3 stores local account passwords in its user table as unsalted MD5 digests. An attacker who gets a copy of that table can recover passwords, including administrator passwords, with precomputed tables or GPU cracking.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SQLBot version in use; versions up to and including `1.10.3` are described as affected.
- Look at the `sys_user` table's password column; unsalted 32-character hex values indicate MD5 hashing.

## Timeline

- 2026-11-13T17:48:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129127

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-weak-password-hashing-via-unsalted-md5
- [fix] Patch: github.com https://github.com/dataease/SQLBot/commit/8b4097f216d0d57e7c82f12ef6b36add1f64e49e

## From the sources

SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_