CVE-2026-82039: UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UTMStackto a version that resolves this vulnerability.Fixed in 11.2.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authentication to access the affected API endpoint. The endpoint is network-accessible at GET /api/utm-asset-groups/searchGroupsByFilter.
What level of access could successful exploitation provide?
Injected SQL executes with DBA privileges. This can allow full database reads and modifications, with potential filesystem access.
How can I determine whether my deployment is affected?
UTMStack versions before 11.2.16 are affected. Review whether authenticated users can reach the searchGroupsByFilter endpoint and whether the deployment is running a version earlier than 11.2.16.