CVE-2026-75786: SQL Injection in Grafana Integration Endpoint (query.php)

Published Oct 1, 2026

Updated

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.

Affected Software

1 affected component

Pandora FMS Pandora FMS>=777

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in 800.6
Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in 805

Event History

Oct 1, 2026

CVE Published

via MITRE·09:30 AM

Data Sourced

via MITRE·09:30 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to reach the affected Grafana datasource endpoint. The provided information does not indicate that unauthenticated users can exploit it.

Which deployments should be considered affected?

Pandora FMS versions from 777 onwards are affected. The issue is in the Grafana integration endpoint query.php, so deployments using that endpoint should be prioritized for review.

What is the impact of successful exploitation?

The vulnerability allows blind SQL injection through the module parameter. Because the injection is blind, an attacker may be able to infer database information through application responses or behavior rather than receiving query results directly.