CVE-2026-7023

Vulnerability

Overview CVE-2026-7023 is an SQL injection vulnerability in ByteDance coze-studio up to version 0.5.1. The flaw resides in the ExecuteSQL function within backend/domain/memory/database/service/database_impl.go. The software-defined Web Application Firewall (WAF) attempts to block dangerous SQL keywords by uppercasing queries and checking for substrings like INFORMATION_SCHEMA or MYSQL.. However, attackers can bypass this filter by using MySQL backticks (e.g., ` mysql.user ), which after ToUpper() becomes MYSQL.USER and fails to match MYSQL.` due to the absence of a dot after the first string. Additionally, parentheses can be used to disrupt regex extraction grouping, further evading validation [1].

Exploitation

The attack can be initiated remotely without authentication. A prompt injector can craft a malicious SQL statement using these evasion techniques, tricking the application into executing arbitrary queries against the internal relational database [1]. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Impact

Successful exploitation allows an attacker to execute uncontrolled SQL queries as the root database user. This enables unauthorized retrieval of sensitive assets, including TiDB/MySQL backend hashes and cross-tenant schema data, potentially leading to data breaches and privilege escalation [1].

Mitigation

As of the publication date, the vendor has not responded to disclosure reports, and no official patch or workaround is available. Users should consider isolating the affected service or applying network-level restrictions to mitigate exposure until a fix is provided [1].