# Aix-DB Missing Auth Allows Unauthenticated SQL Access

Published: 2026-06-10 · Severity: medium
Canonical: https://vorant.io/reports/e6b0adbc-4bac-5f74-929e-23d63eb18d29/aix-db-missing-auth-allows-unauthenticated-sql-access

> An unpatched authentication bypass in Aix-DB's LLM endpoint lets unauthenticated attackers run arbitrary SELECT queries and pull database contents.

CERT Polska coordinated disclosure of CVE-2026-8335, a vulnerability in Aix-DB software affecting the /llm/process_llm_out endpoint. Unlike other endpoints in the application, this one lacks the token validation check normally enforced, allowing unauthenticated clients to send arbitrary SELECT SQL queries and retrieve database data without any credentials.

All releases up to and including 1.2.4 are confirmed vulnerable. No patch has been issued at the time of disclosure, and the vendor's remediation status for future releases is unknown. Organizations running Aix-DB should treat this as an unresolved exposure and consider restricting network access to the affected endpoint until a fix is available. The vulnerability was reported by researcher Eryk Winiarz through CERT Polska's coordinated vulnerability disclosure process.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8335

## Detection guidance (public sample)

### Unauthenticated SQL Query via Aix-DB /llm/process_llm_out Endpoint

ATT&CK: T1190

Detects HTTP requests to the vulnerable Aix-DB /llm/process_llm_out endpoint carrying SQL SELECT syntax, indicating exploitation of CVE-2026-8335 missing authentication check. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated SQL Query via Aix-DB process_llm_out Endpoint
id: 822a2548-e2c9-59b4-9462-16eb661458d3
status: experimental
description: Detects HTTP requests to the Aix-DB /llm/process_llm_out endpoint that
  embed SQL SELECT statements in the request, consistent with exploitation of CVE-2026-8335
  where the endpoint lacks token validation and accepts arbitrary SELECT queries without
  authentication.
references:
- CVE-2026-8335
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /llm/process_llm_out
  sql_indicators:
    cs-uri-query|contains:
    - 'select '
    - select%20
    - 'SELECT '
    - union select
    - UNION SELECT
  condition: selection and sql_indicators
falsepositives:
- Internal reporting or BI tools that legitimately query this endpoint with SELECT-style
  parameters before the vendor enforces authentication
- Automated vulnerability scanners performing authorized security assessments
level: high
```

### Repeated Access to Aix-DB Vulnerable Endpoint Without Authentication Header

ATT&CK: T1190

Detects repeated unauthenticated HTTP requests to the Aix-DB /llm/process_llm_out endpoint, a pattern consistent with probing or exploitation of the missing token validation vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Repeated Unauthenticated Requests to Aix-DB Vulnerable Endpoint
id: c30343c1-5fe0-58a4-bd64-371c1983bc4f
status: experimental
description: Detects HTTP POST or GET requests to the /llm/process_llm_out endpoint
  of Aix-DB lacking any Authorization or token header, indicating attempts to exploit
  CVE-2026-8335's missing authentication check. Multiple such requests from the same
  source in a short window should be treated as high-confidence exploitation attempts;
  correlate manually if your SIEM supports it since Sigma condition syntax here does
  not support counting.
references:
- CVE-2026-8335
author: Vorant
tags:
- attack.t1190
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: /llm/process_llm_out
    cs-method:
    - GET
    - POST
  filter:
    cs-Authorization|exists: true
  condition: selection and not filter
falsepositives:
- Legitimate application clients that send an Authorization header even though the
  endpoint does not enforce it
- Internal health-check or monitoring probes hitting the endpoint without credentials
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-8335

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e6b0adbc-4bac-5f74-929e-23d63eb18d29/aix-db-missing-auth-allows-unauthenticated-sql-access.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup