SQL Injection Vulnerability in ChirpStack's SQLite Device Tag Filtering

CVE-2026-71282

What is CVE-2026-71282?

A vulnerability exists in ChirpStack's SQLite backend that allows authenticated users to inject SQL queries through improperly handled user-supplied tag keys in device tag filtering. The vulnerability arises when the application interpolates these keys directly into raw SQL fragments, allowing for manipulation of database queries. This flaw is particularly concerning for users with device-list access using the SQLite backend, as it may lead to unauthorized information disclosure or alteration of data. In contrast, the PostgreSQL backend remains secure due to the use of safer JSONB containment operators.

References