Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Telegraf may let attackers run unauthorized database commands
published 6 months ago
Summary
Versions of Telegraf older than 1.31.0-22 use a database component that can be tricked into executing attacker‑controlled commands. This could let someone read, change, or delete data stored in the database. Upgrade Telegraf to version 1.31.0-22 or later (or ensure the underlying database driver is updated) to eliminate the risk.
What to do
- Update azure telegraf to version 1.31.0-22.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | telegraf |
< 1.31.0-22 Fix: upgrade to 1.31.0-22
|
Original advisory text
CVE-2026-41889 affecting package telegraf for versions less than 1.31.0-22
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.
References
Timeline
Published8 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-86325 · OSV
Track software like this
Free during beta