SQL Injection Vulnerability in Magistrala API Affecting PostgreSQL and TimescaleDB
CVE-2026-71276

7.1HIGH

Key Information:

Vendor

Absmach

Status
Magistrala
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71276?

The Magistrala message-readers API suffers from a SQL injection vulnerability due to improper handling of the format parameter in HTTP query strings. An authenticated user can exploit this flaw by injecting malicious SQL code, which the application then directly executes against the PostgreSQL or TimescaleDB databases. This vulnerability arises from the use of fmt.Sprintf() without adequate validation, enabling unauthorized access to channel messages. It is crucial for affected users to implement security patches and restrict API access to trusted entities.

Affected Version(s)

magistrala 0

References

https://github.com/absmach/magistrala
https://github.com/absmach/magistrala/blob/main/readers/p...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alibek Baxtiyorov
.