CVE-2026-2613: SQL Injection
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.
A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires administrator privileges and network access to the Admin REST API. The attacker must be able to supply crafted input to affected API functionality.
What could an attacker achieve?
An administrator could perform blind SQL injection to infer information from the database. The issue may also affect database-service availability.
Is this exploitable without authentication?
No. The provided vector lists privileges required as high, and the description specifies that an attacker needs administrator privileges.