CVE-2026-8335: Missing authentication in Aix-DB

Synopsis

Missing authentication on a specific API endpoint in Aix-DB allows any client reachable over the local network or adjacent segment to issue arbitrary SELECT queries without supplying credentials. The "/llm/process_llm_out" endpoint skips the token validation applied to every other route, meaning an attacker with network access can query the database directly. Successful exploitation gives the attacker full read access to database contents. No patch is currently available; HarborGuard tracks the advisory for fix availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network segment, such as a LAN or VPN, to reach the Aix-DB service; remote internet-based exploitation is not indicated by the AV:A vector.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the affected endpoint performs no token validation.

• Victim interactionNot required

  The attacker sends requests directly to the endpoint; no action by a logged-in user or administrator is required.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, memory-layout knowledge, or environmental prerequisites.

Blast Radius

• The attacker can read all data stored in the database by issuing arbitrary SELECT queries through the unauthenticated endpoint.
• Sensitive records such as user credentials, session tokens, application configuration, and any LLM-related output stored in the database are directly readable.
• Because integrity and availability impact tokens are None, the attacker cannot modify or delete data, and the service itself is not disrupted by this exploit path.