Aix-DB Missing Auth Allows Unauthenticated SQL Access
An unpatched authentication bypass in Aix-DB's LLM endpoint lets unauthenticated attackers run arbitrary SELECT queries and pull database contents.
CERT Polska coordinated disclosure of CVE-2026-8335, a vulnerability in Aix-DB software affecting the /llm/process_llm_out endpoint. Unlike other endpoints in the application, this one lacks the token validation check normally enforced, allowing unauthenticated clients to send arbitrary SELECT SQL queries and retrieve database data without any credentials.
All releases up to and including 1.2.4 are confirmed vulnerable. No patch has been issued at the time of disclosure, and the vendor's remediation status for future releases is unknown. Organizations running Aix-DB should treat this as an unresolved exposure and consider restricting network access to the affected endpoint until a fix is available. The vulnerability was reported by researcher Eryk Winiarz through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Unauthenticated SQL Query via Aix-DB /llm/process_llm_out Endpoint
Detects HTTP requests to the vulnerable Aix-DB /llm/process_llm_out endpoint carrying SQL SELECT syntax, indicating exploitation of CVE-2026-8335 missing authentication check. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated SQL Query via Aix-DB process_llm_out Endpoint
id: 822a2548-e2c9-59b4-9462-16eb661458d3
status: experimental
description: Detects HTTP requests to the Aix-DB /llm/process_llm_out endpoint that
embed SQL SELECT statements in the request, consistent with exploitation of CVE-2026-8335
where the endpoint lacks token validation and accepts arbitrary SELECT queries without
authentication.
references:
- CVE-2026-8335
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /llm/process_llm_out
sql_indicators:
cs-uri-query|contains:
- 'select '
- select%20
- 'SELECT '
- union select
- UNION SELECT
condition: selection and sql_indicators
falsepositives:
- Internal reporting or BI tools that legitimately query this endpoint with SELECT-style
parameters before the vendor enforces authentication
- Automated vulnerability scanners performing authorized security assessments
level: high
Repeated Access to Aix-DB Vulnerable Endpoint Without Authentication Header
Detects repeated unauthenticated HTTP requests to the Aix-DB /llm/process_llm_out endpoint, a pattern consistent with probing or exploitation of the missing token validation vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Unauthenticated Requests to Aix-DB Vulnerable Endpoint
id: c30343c1-5fe0-58a4-bd64-371c1983bc4f
status: experimental
description: Detects HTTP POST or GET requests to the /llm/process_llm_out endpoint
of Aix-DB lacking any Authorization or token header, indicating attempts to exploit
CVE-2026-8335's missing authentication check. Multiple such requests from the same
source in a short window should be treated as high-confidence exploitation attempts;
correlate manually if your SIEM supports it since Sigma condition syntax here does
not support counting.
references:
- CVE-2026-8335
author: Vorant
tags:
- attack.t1190
logsource:
category: proxy
detection:
selection:
c-uri|contains: /llm/process_llm_out
cs-method:
- GET
- POST
filter:
cs-Authorization|exists: true
condition: selection and not filter
falsepositives:
- Legitimate application clients that send an Authorization header even though the
endpoint does not enforce it
- Internal health-check or monitoring probes hitting the endpoint without credentials
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-8335
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free