SQL Injection Vulnerability in Magistrala Affected by Postgres and Timescale-Reader Services

CVE-2026-82028

What is CVE-2026-82028?

Magistrala versions prior to 1.0.0 exhibit a SQL injection vulnerability within the timescale-reader and postgres-reader HTTP API services. This flaw arises when authenticated users manipulate the format query parameter, leading to direct interpolation into the SQL FROM clause without required parameterization or quoting. Exploiting this vulnerability, attackers with self-registered accounts can perform cross-tenant data reads, extract sensitive data such as pg_shadow password hashes, access and modify arbitrary files, and even execute commands as the postgres OS user by loading malicious shared objects. All injected SQL commands would execute at superuser privilege because of PostgreSQL's default role settings.

References