SQL Injection Vulnerability in Anchore Enterprise's GraphQL Reports API
CVE-2026-25076

8.5HIGH

Key Information:

Vendor

Anchore

Status
Anchore Enterprise
Vendor
CVE Published:
12 March 2026

What is CVE-2026-25076?

The Anchore Enterprise platform, prior to version 5.25.1, is susceptible to an SQL injection vulnerability within its GraphQL Reports API. An individual with authenticated access to the GraphQL API can potentially execute arbitrary SQL commands, leading to unauthorized modifications of the Anchore Enterprise database. Organizations utilizing this software should promptly upgrade to version 5.25.1 or later to mitigate this risk. For more information, please visit the official release notes and advisory.

Affected Version(s)

Anchore Enterprise 0 < 5.25.1

References

https://docs.anchore.com/current/docs/release_notes/enter...
release-notespatch
https://anchore.com/platform/
product
https://www.vulncheck.com/advisories/anchore-enterprise-g...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Van Fleteren
.