CVE-2026-8335 HIGH

CVE-2026-8335: Missing authentication in Aix-DB

Vendor Aix-Db
Product Aix-DB
Weakness CWE-306 · Missing auth
Published June 10, 2026
Last update June 10, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.

Key dates

02Disclosure timeline

June 10, 2026 CVE published
June 10, 2026 Record updated