CVE-2026-129171: NginxPulse 1.5.0 before 1.6.26 SQL Injection via /api/stats/:type

Q: Which deployments are exposed?

NginxPulse versions from 1.5.0 up to, but not including, 1.6.26 are affected. The vulnerable endpoint can be targeted remotely without authentication.

Q: What access or preconditions does an attacker need?

No credentials or user interaction are required. An attacker needs to be able to send requests to the /api/stats/:type endpoint and supply the id and locationType parameters.

Q: What could an attacker obtain or modify?

An attacker can use error-based output to read database contents. Where PostgreSQL superuser functions are available, the issue can also enable reading from or writing to server files.

Q: What version should be deployed to address the issue?

Upgrade to NginxPulse 1.6.26 or later.

Published Nov 13, 2026

Updated

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.

Affected Software

1 affected component

NginxPulse NginxPulse>=1.5.0<1.6.26

Event History

Nov 13, 2026

CVE Published

via MITRE·05:21 PM

Data Sourced

via MITRE·05:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

NginxPulse versions from 1.5.0 up to, but not including, 1.6.26 are affected. The vulnerable endpoint can be targeted remotely without authentication.

What access or preconditions does an attacker need?

No credentials or user interaction are required. An attacker needs to be able to send requests to the /api/stats/:type endpoint and supply the id and locationType parameters.

What could an attacker obtain or modify?

An attacker can use error-based output to read database contents. Where PostgreSQL superuser functions are available, the issue can also enable reading from or writing to server files.

What version should be deployed to address the issue?

Upgrade to NginxPulse 1.6.26 or later.

CVE-2026-129171: NginxPulse 1.5.0 before 1.6.26 SQL Injection via /api/stats/:type

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What access or preconditions does an attacker need?

What could an attacker obtain or modify?

What version should be deployed to address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access or preconditions does an attacker need?

What could an attacker obtain or modify?

What version should be deployed to address the issue?