CVE-2026-32622 in SQLBot
Summary
by MITRE • 03/20/2026
SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability that chains three flaws: a missing permission check on the Excel upload API allowing any authenticated user to upload malicious terminology, unsanitized storage of terminology descriptions containing dangerous payloads, and a lack of semantic fencing when injecting terminology into the LLM's system prompt. Together, these flaws allow an attacker to hijack the LLM's reasoning to generate malicious PostgreSQL commands (e.g., COPY ... TO PROGRAM), ultimately achieving Remote Code Execution on the database or application server with postgres user privileges. The issue is fixed in v1.6.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/24/2026
The vulnerability identified as CVE-2026-32622 represents a sophisticated chain of security flaws within SQLBot, a data query system leveraging large language models and Retrieval-Augmented Generation techniques. This system, designed to facilitate intelligent data interrogation through natural language interfaces, contains a critical Stored Prompt Injection vulnerability that fundamentally compromises its security posture. The flaw affects versions 1.5.0 and below, creating a dangerous attack surface that enables unauthorized privilege escalation through carefully crafted malicious inputs.
The attack vector begins with a critical missing permission check on the Excel upload API functionality, which allows any authenticated user to upload malicious terminology files without proper authorization validation. This permission bypass represents a fundamental security architecture failure that violates the principle of least privilege and demonstrates poor access control implementation. The system fails to properly validate user permissions before permitting file uploads, creating an entry point for malicious actors to introduce harmful content into the system's terminology database.
Once malicious terminology is uploaded, the system stores these descriptions without proper sanitization or validation, creating a persistent storage vulnerability that allows dangerous payloads to remain within the system's data structures. This unsanitized storage represents a classic data sanitization failure that enables the persistence of malicious content within the application's database. The terminology descriptions contain payloads that can be later exploited during the prompt injection process, as the system does not perform adequate input validation or sanitization before storing user-provided content.
The most critical component of this vulnerability chain occurs when the system injects stored terminology into the LLM's system prompt without implementing semantic fencing or proper input isolation. This lack of semantic boundaries creates a prompt injection vulnerability where attacker-controlled content can influence the LLM's reasoning process and output generation. The system fails to properly isolate user inputs from the system's core operational logic, allowing malicious payloads to be seamlessly integrated into the LLM's prompt engineering process.
The ultimate exploitation of this vulnerability enables attackers to hijack the LLM's reasoning capabilities to generate malicious PostgreSQL commands, specifically targeting the COPY ... TO PROGRAM functionality that can execute arbitrary system commands. This represents a severe privilege escalation vulnerability that allows attackers to achieve Remote Code Execution on the database or application server with postgres user privileges. The attack demonstrates how prompt injection can be weaponized to bypass traditional security controls and directly compromise underlying database systems through the LLM's natural language processing capabilities.
This vulnerability aligns with CWE-79 (Cross-site Scripting) and CWE-94 (Code Injection) categories, while also mapping to ATT&CK techniques including T1059.001 (Command and Scripting Interpreter: PowerShell) and T1078 (Valid Accounts) through the privilege escalation pathway. The attack chain exemplifies how modern AI-powered applications require comprehensive security controls beyond traditional input validation, as the LLM's prompt engineering process becomes a critical attack surface that must be properly secured against malicious input injection.
The fix implemented in version 1.6.0 addresses all three components of this vulnerability chain through proper permission validation on the Excel upload API, implementation of robust input sanitization for stored terminology, and introduction of semantic fencing mechanisms to prevent prompt injection during LLM prompt construction. These mitigations align with industry best practices for securing AI-powered applications and demonstrate the importance of comprehensive security testing for systems that integrate machine learning capabilities with traditional database operations. The vulnerability highlights the critical need for security considerations in AI application design, particularly when systems process user inputs that may influence core operational logic through natural language interfaces.