Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Magistrala before 1.0.0 lets logged‑in users run any SQL

CVE-2026-82028 · published 13 days ago
Summary

The Magistrala platform version earlier than 1.0.0 allows a user who has signed up for an account to place a specially crafted value in a request parameter, which then gets executed as database code with full privileges. This can let the attacker read data from other customers, steal password hashes, access or modify files, and even run code on the server. Upgrade to version 1.0.0 or later, or apply the vendor’s patch, and restrict database privileges for the service accounts.

What to do
  • Update absmach magistrala to version 1.0.0 or later.
Affected software
VendorProductAffected versions
absmach magistrala < 1.0.0
Original advisory text
Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without parameterization or identifier quoting. Attackers with a self-registered account can substitute arbitrary subqueries to achieve cross-tenant database reads, extract pg_shadow password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects, with all injected SQL executing at superuser privilege due to the default PostgreSQL role configuration.
References
Severity
9.4 Critical
CVSS 3.1: 8.8 (NVD)
CVSS 4.0: 8.7 (NVD)
Exploitation
EPSS <1%
Type
CWE-89SQL Injection
Timeline
Published14 Sep 2026
Updated27 Sep 2026
First seen14 Sep 2026
Sources
CVE-2026-82028 · NVD
CVE-2026-82028 · MITRE
CVE-2026-82028 · OSV
Track software like this
Free during beta