CVE-2026-57190: Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

Q: Which deployments are exposed to this issue?

Only deployments that load and configure the cel_pgsql or cel_tds CEL backend are affected. Deployments using other CEL backends are not identified as affected by the available information.

Q: What must an attacker control for exploitation to be possible?

Untrusted data must be passed into the eventtype field through the CELGenUserEvent dialplan application. Exploitation depends on an administrator having a dialplan call to CELGenUserEvent that does not restrict the input to valid data.

Q: Are default installations necessarily vulnerable?

No. The affected CEL backend must be loaded and configured, and the dialplan must invoke CELGenUserEvent with insufficient validation of its input.

Q: What can be done before upgrading?

Ensure that every CELGenUserEvent dialplan invocation accepts only validated, expected eventtype values, and do not pass untrusted data to it. Where feasible, disable or avoid the cel_pgsql and cel_tds backends until remediation is complete.

Q: Which releases contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends celpgsql and celtds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The celpgsql or celtds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

2 affected components

Asterisk Asterisk<20.20.1, <21.12.3, <22.10.1, <23.4.1

Asterisk Certified Asterisk<20.7-cert11, <22.8-cert3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3
Compensating control
When using CELGenUserEvent with the cel_pgsql or cel_tds backend, ensure that only valid data is passed to the CEL eventtype column.

Event History

Oct 27, 2026

CVE Published

via MITRE·09:45 PM

Data Sourced

via MITRE·09:45 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Only deployments that load and configure the cel_pgsql or cel_tds CEL backend are affected. Deployments using other CEL backends are not identified as affected by the available information.

What must an attacker control for exploitation to be possible?

Untrusted data must be passed into the eventtype field through the CELGenUserEvent dialplan application. Exploitation depends on an administrator having a dialplan call to CELGenUserEvent that does not restrict the input to valid data.

Are default installations necessarily vulnerable?

No. The affected CEL backend must be loaded and configured, and the dialplan must invoke CELGenUserEvent with insufficient validation of its input.

What can be done before upgrading?

Ensure that every CELGenUserEvent dialplan invocation accepts only validated, expected eventtype values, and do not pass untrusted data to it. Where feasible, disable or avoid the cel_pgsql and cel_tds backends until remediation is complete.

Which releases contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-57190: Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control for exploitation to be possible?

Are default installations necessarily vulnerable?

What can be done before upgrading?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control for exploitation to be possible?

Are default installations necessarily vulnerable?

What can be done before upgrading?

Which releases contain the fix?