CVE-2026-5417 | Dataease SQLbot up to 1.6.0 Elasticsearch es_engine.py get_es_data_by_http address server-side request forgery

A vulnerability identified as critical has been detected in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of the component Elasticsearch Handler. This manipulation of the argument address causes server-side request forgery.

This vulnerability appears as CVE-2026-5417. The attack may be initiated remotely. In addition, an exploit is available.

You should upgrade the affected component.

The vendor was contacted early about this disclosure.