Retrieval-augmented generation

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18875, a RAG poisoning flaw (CWE-74) caused by an unauthenticated runbook upsert in the FTM AI agent server at api.vectordb.runbooks.js:51. An unauthenticated attacker can insert malicious runbook content into the agent's vector database. This can steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.

SQLBot, a Text-to-SQL system built on large language models and RAG, is affected by CVE-2026-53556 before version 1.9.0. The POST /api/v1/datasource/previewData endpoint places the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can use a crafted table_name to call pg_read_file(), pg_read_binary_file() or pg_ls_dir() through a datasource pointed at the internal PostgreSQL service, reading filesystem content such as /etc/hosts and /etc/passwd, and potentially configuration, credentials and source code. In the default tested trusted loopback authentication configuration, the connection runs with PostgreSQL superuser privileges.

CVE-2026-53554 affects SQLBot, a Text-to-SQL system built on large language models and RAG, prior to 1.9.0. The POST /api/v1/datasource/parseExcel endpoint trusts attacker-controlled multipart filenames when choosing storage, and it writes uploaded content before spreadsheet parsing and validation finish. A crafted upload can plant a Python file in /opt/sqlbot/app/alembic/versions/ even when parsing fails and the endpoint returns an error. On the next startup or migration, Alembic imports that file and runs its module-level statements inside the SQLBot runtime.

FlowiseAI's OpenAI Assistants vector store routes at packages/server/src/routes/openai-assistants-vector-store/index.ts have no checkAnyPermission() middleware on any CRUD operation. Any authenticated user, regardless of role, can create, update, or delete vector stores, upload files to them, and delete files. The source rates the issue HIGH (CVSS ~8.1) under CWE-306 and says the impact includes uploading malicious files and exfiltrating stored documents.

CVE-2026-42463 affects SQLBot versions prior to 1.8.0, a Text-to-SQL system built on large language models and RAG. The /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints contain a Cross-Workspace IDOR and authorization bypass (CWE-639), letting an attacker access and modify database schemas and data sources belonging to other tenants or workspaces. GitHub rates it CVSS 4.0 8.6 (HIGH); NVD has not yet provided an assessment.

CVE-2026-35486 affects text-generation-webui before 4.3, specifically the superbooga and superboogav2 RAG extensions. These extensions fetch user-supplied URLs with requests.get() and perform no scheme check, IP filtering, or hostname allowlisting. An attacker can reach cloud metadata endpoints, steal IAM credentials, probe internal services, and exfiltrate the fetched content through the RAG pipeline.

SQLBot, an LLM and RAG-based data query system, has an SSRF vulnerability in versions prior to 1.7.0. An attacker can abuse the /api/v1/datasource/check endpoint with a forged MySQL data source using extraJdbc="local_infile=1", so the backend connects to an attacker-controlled rogue MySQL server that issues a LOAD DATA LOCAL INFILE command during the handshake. This makes the target read arbitrary local files, such as /etc/passwd or configuration files, and send their contents back to the attacker.

CVE-2026-25628 affects Qdrant, a vector similarity search engine and vector database, in versions from 1.9.3 up to but not including 1.16.0. An attacker with read-only access can append to arbitrary files through the /logger endpoint by supplying a controlled on_disk.log_file path. The weakness is classified as CWE-73, External Control of File Name or Path.