CVE-2026-129127
SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5
CVSS Score
4.4
EPSS Score
0.0%
EPSS Percentile
0th
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.
| CWE | CWE-916 |
| Vendor | dataease |
| Product | sqlbot |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for dataease sqlbot
Be the first to know when new medium vulnerabilities affecting dataease sqlbot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
dataease / SQLBot
0 ≤ 1.10.3
References
github.com: https://github.com/dataease/SQLBot/issues/1432 github.com: https://github.com/dataease/SQLBot github.com: https://github.com/dataease/SQLBot/commit/8b4097f216d0d57e7c82f12ef6b36add1f64e49e github.com: https://github.com/dataease/SQLBot/pull/1466 github.com: https://github.com/dataease/SQLBot/blob/96f06c7eade60ecf3e6af0313821373761d1fb85/backend/common/core/security.py#L32-L35 vulncheck.com: https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-weak-password-hashing-via-unsalted-md5
Credits
George Chen fit2cloud-chenyw