SQL Injection Vulnerability in NginxPulse Affects Multiple Versions

CVE-2026-129171

What is CVE-2026-129171?

NginxPulse versions 1.5.0 and prior to 1.6.26 are susceptible to an unauthenticated SQL injection vulnerability, enabling remote attackers to manipulate SQL queries through the id and locationType parameters found in the /api/stats/:type endpoint. This flaw can allow malicious actors to terminate the quoted table-name identifier and exploit error-based outputs to gain unauthorized access to database contents. Furthermore, attackers may read or write server files utilizing PostgreSQL superuser functions, posing a significant threat to the integrity and confidentiality of sensitive data.

References