diff --git a/crates/df-storage/src/crud.rs b/crates/df-storage/src/crud.rs
index fee1a64..0748262 100644
--- a/crates/df-storage/src/crud.rs
+++ b/crates/df-storage/src/crud.rs
@@ -335,7 +335,8 @@ fn validate_column_name(field: &str, table: &str) -> Result<()> {
     match allowed_columns_for(table) {
         Some(cols) if cols.contains(&field) => Ok(()),
         Some(_) => Err(Error::Storage(format!("表 {} 不允许的字段名: {}", table, field))),
-        None => Ok(()),
+        // 未登记表保守拒绝(FR-S6: 原放行 Ok，若未来未登记表走通用查询路径，列名直进字符串拼接即 SQL 注入；与 is_allowed_column 的 None=>false 对齐)
+        None => Err(Error::Storage(format!("表 {} 未登记列白名单，拒绝防注入", table))),
     }
 }