CVE-2026-10880: Unauthenticated SQL Injection in Osnexus Quantastor
OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a valid password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the QuantaStor SDS Manager management/login endpoint using firewall rules, ACLs or segmentation so that only trusted management hosts or a VPN can reach it. Block access from untrusted networks, including the public Internet.
- Compensating control
Deploy a Web Application Firewall (WAF) or intrusion prevention system in front of the login endpoint and enable SQL injection/HTTP request inspection rules to detect and block SQLi payloads targeting the login form.
- Operational
Assume possible admin account compromise and rotate all administrator credentials and API keys for QuantaStor instances. Invalidate existing sessions and require re-authentication after credentials are changed.
- Operational
Audit logs and system activity for signs of unauthorized access or configuration changes via the login endpoint (failed/successful logins, new admin actions). Preserve logs for investigation and remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10880?
The severity of CVE-2026-10880 is critical with a score of 9.8.
How does CVE-2026-10880 affect OSNexus QuantaStor?
CVE-2026-10880 allows unauthenticated remote attackers to execute SQL injection attacks via the login endpoint.
How can I fix CVE-2026-10880?
To fix CVE-2026-10880, update to the latest version of OSNexus QuantaStor that includes the patch for the SQL injection vulnerability.
What can attackers do with CVE-2026-10880?
Attackers exploiting CVE-2026-10880 can bypass authentication and log in as an administrator without valid credentials.
Is CVE-2026-10880 a common vulnerability?
CVE-2026-10880 is a serious vulnerability due to its nature as an unauthenticated SQL injection flaw, which is a common attack vector.