CVE-2026-124850— SQL Injection in Database Migration via Stored Connector Identifiers in flowintel

Quick assessment

Affected

flowintel flowintel

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

flowintel 的数据库迁移脚本中存在 SQL 注入漏洞。该迁移过程会从数据库中读取已存储的连接器标识符（connector identifier）值，并将其直接拼接到 SQL 语句中，而未采用参数化查询。若攻击者此前已在受影响的表中写入恶意的标识符值，则在后续应用升级过程中执行迁移时，将导致任意 SQL 代码被执行。需要攻击者具备对数据库的先前写入权限，以植入恶意标识符值；在迁移或升级操作期间自动触发；可能导致未经授权的數據泄露、篡改或删除。受影响版本：flowintel 4.0.0 之前的所有版本

CVSS 7.3 · High Updated Nov 09, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
flowintel	flowintel	`≤ 4.0.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SQL Injection in Database Migration via Stored Connector Identifiers in flowintel

Source: CVE Program / CVE List V5

Vulnerability Description

A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade. - Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion Affected versions: flowintel prior to 4.0.0

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
flowintel	flowintel	0 ~ 4.0.0	`cpe:2.3:a:flowintel:flowintel::::::::`

II. Public POCs for CVE-2026-124850

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124850

请登录查看更多情报信息。

Other References for CVE-2026-124850 (1)

https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d patch

https://www.cve.org/CVERecord?id=CVE-2026-124850

IV. Related Vulnerabilities

Same product: flowintel

Same vendor: flowintel

Same weakness: CWE-89