External risk intelligence

mfish-nocode-pro tableName SQL Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-79570

The vulnerability exists in an API endpoint (/sys/dbConnect/data) within a web-based application. Such web applications and their associated API endpoints are commonly deployed as internet-facing services, making them reachable from the public internet in typical configurations.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in a database connectivity feature of the mfish-nocode-pro product. This issue could allow unauthorized access to sensitive database information if exploited. The main concern at this stage is to confirm if this technology is in use and, if so, assess the potential exposure.

Attackers can access database information.
Confirming product use and exposure is key.
Understand potential data access risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a web application's API endpoint. This request would target the `tableName` parameter within the `/sys/dbConnect/data` function. If successful, the attacker could manipulate the underlying database queries to retrieve sensitive information.

No authentication required.
Triggered via crafted API request.
Leads to sensitive data exposure.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the `tableName` parameter could allow an unauthenticated attacker to execute arbitrary SQL commands. This could lead to unauthorized access to sensitive database information when the affected component is exposed to the network.

Sensitive database information could be exposed.
An attacker could inject malicious SQL commands.
Unauthorized access to database contents.

Operational Fix

Recommended remediation, mitigation, and detection steps

The mfish-nocode-pro application's SQL injection vulnerability requires immediate attention from teams responsible for database security and application oversight. The first critical step is to identify all instances of mfish-nocode-pro, determine their accessibility from the network, and assess their business criticality. Once the accountable owner is confirmed, a remediation plan can be established based on the identified risks.

Application owners must prioritize remediation efforts.
Verify external reachability and business criticality first.
Plan for vendor coordination and risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mfish-nocode-pro?

mfish-nocode-pro is a software platform designed to help users build applications without traditional coding. It includes database connectivity features, which allow the system to interact with backend data sources to support its no-code functionality.

What does SQL injection mean for CVE-2026-79570?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, it means the application fails to properly filter user input. An attacker can insert their own database commands into the tableName parameter, tricking the software into revealing information it should keep private.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted request to the /sys/dbConnect/data API endpoint. Because the vulnerability exists in the way the application processes input, it does not require the attacker to have a legitimate account or authentication credentials to attempt the injection.

Is my instance of mfish-nocode-pro at risk?

Halo Surface Signal indicates that because this vulnerability exists within an API endpoint often deployed as an internet-facing service, your instance is more likely to be reachable by external attackers. You should evaluate if your deployment is accessible from the public internet versus restricted to an internal-only network.

What should I do first to address this issue?

Begin by creating an inventory of all mfish-nocode-pro instances within your environment. Once identified, verify which systems are reachable from the network and determine their business importance. Use this information to coordinate with the appropriate system owners to plan for risk reduction and future remediation.

References

github.com/fangtang7/CVE/blob/main/mfish-nocode/sql.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.