Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-34400: Alerta Search API allows attackers to inject malicious SQL code
CVE-2026-34400
GHSA-8prr-286p-4w7j
GHSA-8prr-286p-4w7j
PYSEC-2026-2341
Summary
A security flaw in the search feature of the Alerta monitoring tool allowed hackers to inject malicious code, potentially exposing sensitive data. This has been fixed in version 9.1.0, so update to this version to stay secure.
What to do
- Update alerta-server to version 9.1.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | alerta-server |
< 9.1.0 Fix: upgrade to 9.1.0
|
| – | alerta_project | alerta |
< 9.1.0 cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:* |
Original title
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
Original description
### Impact
The Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings.
### Patches
Fixed in v9.1.0. The Postgres query parser now uses parameterized queries with %(name)s placeholders passed to psycopg2's cursor.execute(), preventing SQL injection through the ?q= parameter. The MongoDB backend was not affected.
### Workarounds
Upgrade to v9.1.0 or later. If unable to upgrade, deploy a proxy in front of the Alerta API to sanitize the q= parameter.
### Resources
https://github.com/alerta/alerta/pull/712/files
https://owasp.org/www-community/attacks/SQL_Injection
The Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings.
### Patches
Fixed in v9.1.0. The Postgres query parser now uses parameterized queries with %(name)s placeholders passed to psycopg2's cursor.execute(), preventing SQL injection through the ?q= parameter. The MongoDB backend was not affected.
### Workarounds
Upgrade to v9.1.0 or later. If unable to upgrade, deploy a proxy in front of the Alerta API to sanitize the q= parameter.
### Resources
https://github.com/alerta/alerta/pull/712/files
https://owasp.org/www-community/attacks/SQL_Injection
nvd CVSS4.0
6.9
Vulnerability type
CWE-89
SQL Injection
- https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j
- https://github.com/alerta/alerta/pull/2040
- https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00
- https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883
- https://github.com/advisories/GHSA-8prr-286p-4w7j
- https://github.com/alerta/alerta/pull/712
- https://github.com/alerta/alerta/releases/tag/v9.1.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-34400
- https://github.com/alerta/alerta Product
- https://pypi.org/project/alerta-server Product
Published: 13 Jul 2026 · Updated: 20 Jul 2026 · First seen: 31 Mar 2026