CVE-2026-124850flowintel flowintel SQL Injection
NVD
Vulnerability Summary
A SQL injection vulnerability exists in a database migration script in flowintel.
The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.
- Requires prior write access to the database to plant a malicious identifier value
- Triggered automatically during a migration or upgrade operation
- Can result in unauthorized data disclosure, modification, or deletion
Affected versions: flowintel prior to 4.0.0
The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.
- Requires prior write access to the database to plant a malicious identifier value
- Triggered automatically during a migration or upgrade operation
- Can result in unauthorized data disclosure, modification, or deletion
Affected versions: flowintel prior to 4.0.0
CVSS v4.0 Base Metrics — Score 7.3 (HIGH)
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NAttack VectorLocal
Attack ComplexityHigh
Attack RequirementsPresent
Privileges RequiredLow
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
Affected & Patched Versions
- flowintel flowintel <= 4.0.0
- flowintel flowintel 4.0.0
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is high.
- Check whether you run flowintel flowintel and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Nov 9, 2026Published
- Nov 12, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new flowintel flowintel CVEsYou are reading CVE-2026-124850. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsExternal References
Data last checked: Nov 13, 2026 19:14 UTC