CVE-2026-71276: Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter
Magistrala (formerly Mainflux)'s message-readers API reads a format value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf() in both the PostgreSQL reader (readers/postgres/messages.go: fmt.Sprintf("SELECT FROM %s WHERE %s ...", format, cond)) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71276?
CVE-2026-71276 has a severity rating of high with a score of 7.1.
How do I fix CVE-2026-71276?
To mitigate CVE-2026-71276, you should implement input validation and sanitation on the 'format' parameter in the message-readers API.
What kind of vulnerability is CVE-2026-71276?
CVE-2026-71276 is an SQL Injection vulnerability affecting the Magistrala IoT Platform.
Which software is affected by CVE-2026-71276?
CVE-2026-71276 affects the Magistrala IoT Platform, specifically its message-readers API.
When was CVE-2026-71276 published?
CVE-2026-71276 was published on August 5, 2026.