Aix-DB SQL injection via unauth endpoint
CVE-2026-8335 allows unauthenticated attackers to execute arbitrary SELECT queries against Aix-DB databases through a missing authentication check on the /llm/process_llm_out endpoint.
CERT Polska has disclosed a critical authentication bypass vulnerability in Aix-DB software, tracked as CVE-2026-8335. The vulnerability exists in the /llm/process_llm_out endpoint, which fails to implement the token validation mechanism enforced across all other application endpoints. This design flaw allows unauthenticated remote attackers to execute arbitrary SELECT SQL queries and exfiltrate sensitive database contents without any credentials.
All Aix-DB releases up to version 1.2.4 are confirmed vulnerable. As of this disclosure, the vendor has not released a patch to address the issue, leaving the security posture of subsequent versions uncertain. The vulnerability was responsibly reported by security researcher Eryk Winiarz through CERT Polska's coordinated vulnerability disclosure process.
Organizations running affected Aix-DB versions should assume their database contents are accessible to remote attackers and implement compensating controls such as network segmentation or web application firewall rules to restrict access to the vulnerable endpoint until a fix becomes available.
Mentioned in this report
Detection guidance
Unauthenticated Request to Aix-DB Vulnerable LLM Endpoint
Detects HTTP requests to the /llm/process_llm_out endpoint that bypasses Aix-DB's token validation, enabling unauthenticated SQL query execution (CVE-2026-8335). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Request to Aix-DB Vulnerable LLM Endpoint
id: b5fc624e-e58a-5429-a1d6-53a1c0545d48
status: experimental
description: Detects HTTP requests to the /llm/process_llm_out endpoint, which lacks
the authentication token check enforced elsewhere in Aix-DB, allowing unauthenticated
attackers to run arbitrary SELECT queries (CVE-2026-8335).
references:
- CERT Polska CVE-2026-8335 disclosure
author: Vorant
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /llm/process_llm_out
filter_authorized:
cs-uri-query|contains:
- token=
- auth_token=
condition: selection and not filter_authorized
falsepositives:
- Legitimate internal service calls to this endpoint if the application is later patched
to require tokens
- Automated vulnerability scanners testing the endpoint intentionally as part of authorized
assessments
level: high
tags:
- attack.t1190
- attack.initial_access
SQL Injection Payload Sent to Aix-DB LLM Processing Endpoint
Detects SQL syntax indicative of injection or arbitrary SELECT query execution within requests to the vulnerable /llm/process_llm_out endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Payload Sent to Aix-DB LLM Processing Endpoint
id: a57976f2-6c20-5ac5-acc3-9f0db6cfe823
status: experimental
description: Detects requests to the Aix-DB /llm/process_llm_out endpoint containing
SQL keywords such as SELECT, UNION, or FROM, consistent with exploitation of CVE-2026-8335
to exfiltrate database contents without authentication.
references:
- CERT Polska CVE-2026-8335 disclosure
author: Vorant
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: /llm/process_llm_out
selection_sqli:
cs-uri-query|contains:
- 'SELECT '
- UNION SELECT
- ' FROM '
- --
- ''' OR '
- 1=1
condition: selection_endpoint and selection_sqli
falsepositives:
- Legitimate application queries that pass raw SQL fragments as parameters for debugging
purposes (rare in production)
level: high
tags:
- attack.t1190
- attack.t1213
- attack.initial_access
- attack.collection
Database Exfiltration Response Following Unauthenticated Aix-DB Endpoint Access
Detects large or successful (HTTP 200) responses returned from the unauthenticated /llm/process_llm_out endpoint, suggesting successful extraction of database records via CVE-2026-8335. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Database Exfiltration Response Following Unauthenticated Aix-DB Endpoint Access
id: 166141ae-7c11-5248-a1c0-83b112f63e82
status: experimental
description: Detects HTTP 200 responses with unusually large response body sizes returned
from the vulnerable /llm/process_llm_out endpoint, indicating potential bulk exfiltration
of database records after exploiting CVE-2026-8335.
references:
- CERT Polska CVE-2026-8335 disclosure
author: Vorant
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /llm/process_llm_out
sc-status: 200
sc-bytes|gt: 100000
condition: selection
falsepositives:
- Legitimate bulk data retrieval by internal services or dashboards using this endpoint
before the vulnerability is patched
level: medium
tags:
- attack.t1213
- attack.collection
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-8335
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free