LangChain SQL agent with unrestricted database access
HighAV-FW-002PermissionsFramework pack
What it finds
A LangChain SQL agent is connected to a database with no visible table restriction or read-only connection.
Why it matters
SQL agents write their own queries. Without a read-only role and a table allowlist, one bad instruction can read every table or run UPDATE/DELETE statements.
What an attacker could do: The model could read or change any table the database user can access.
How to fix it
Connect with a read-only database user, pass include_tables to limit what the agent can see, and never give the agent a connection that can modify data.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- LANGCHAIN_SQL_AGENT_UNRESTRICTED
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Agent source using the named framework (LangChain, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, computer-use tools)
- OWASP LLM Top 10
- LLM08 - Excessive Agency, LLM06 - Sensitive Information Disclosure
- NIST AI RMF
- MS-2.3
- SOC 2
- CC6.1, CC6.3
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Overly broad cloud IAM permissionsAV-PERM-003 · Critical
- AI workflow checks out untrusted PR code with secretsAV-PERM-007 · Critical
- Agent's Kubernetes account has cluster-adminAV-PERM-008 · Critical
- No permission or tool scope declaredAV-PERM-001 · High
- Unscoped delegation detectedAV-PERM-002 · High
- Retrieval with no per-customer filterAV-DATA-007 · High