CVE-2026-54628

Anyquery, an SQL query engine built on SQLite, fails to restrict outbound URL fetching when run in server mode in versions prior to 0.4.5. An unauthenticated remote attacker who can reach the MySQL-compatible server port can issue queries against URL-capable virtual table modules such as _reader and log_reader, supplying a crafted loopback, private-network, or link-local cloud metadata URL as the data source. The server process then fetches the target via go-getter and returns the response as queryable table rows, enabling internal network probing, access to internal APIs, and disclosure of cloud credentials, with low-integrity impact possible if a reached internal API performs state-changing actions. Affected deployments are those running 'anyquery server' in any version before 0.4.5 with the MySQL-compatible port reachable over the network without authentication. No public proof of concept or in-the-wild exploitation has been reported, and the issue is fixed in version 0.4.5.

What to do: Upgrade Anyquery to version 0.4.5 or later. If the server must run, bind it to localhost or restrict the MySQL-compatible port with a firewall, and require authentication rather than exposing it unauthenticated. Review query logs for use of _reader or log_reader pointing at loopback, RFC1918, or cloud metadata URLs (e.g., 169.254.169.254), and rotate any cloud credentials that may have been exposed.