Dataease SQLBot up to 1.10.3 Password Hashing security.py md5pwd weak password hash

Summaryinfo

A vulnerability categorized as problematic has been discovered in Dataease SQLBot up to 1.10.3. This affects the function md5pwd of the file security.py of the component Password Hashing. Such manipulation leads to weak password hash. This vulnerability is documented as CVE-2026-129127. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Dataease SQLBot up to 1.10.3. Affected by this issue is the function md5pwd of the file security.py of the component Password Hashing. The manipulation with an unknown input leads to a weak password hash vulnerability. Using CWE to declare the problem leads to CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. Impacted is confidentiality. CVE summarizes:

SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-129127 since 11/13/2026. The exploitation is known to be difficult. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Dataease

Name

• SQLBot

Version

• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3

Website

• Product: https://github.com/dataease/SQLBot/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion