CVE-2026-54629

Anyquery, an SQL query engine built on SQLite, exposes file-backed virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port ('anyquery server') without any authentication, authorization, or directory restrictions in versions prior to 0.4.5. A remote attacker who can reach the server port can issue SQLite CREATE VIRTUAL TABLE statements pointing at arbitrary local file paths; the modules load those files (using hashicorp/go-getter within the server process) and return their contents as queryable table rows. This yields an unauthenticated arbitrary file disclosure limited only by the filesystem permissions of the server process, which can expose system configuration files, credentials, and private keys. Anyone running 'anyquery server' on a version before 0.4.5, especially on a network-reachable interface, is affected; the CLI-only use case is not exposed. The issue is fixed in version 0.4.5, and there is currently no known public PoC or evidence of in-the-wild exploitation.

What to do: Upgrade Anyquery to version 0.4.5 or later, which closes unauthenticated access to the file-backed virtual table modules. If server mode must be used before upgrading, bind it to localhost or restrict the MySQL-compatible port with a firewall, and run the process under a low-privilege account with minimal filesystem read access. Review logs for unexpected connections or CREATE VIRTUAL TABLE queries against local paths, and rotate any credentials or private keys that were readable by the server process.