CVE-2026-34400 json
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
published 2026-03-31 7 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-17664 , GHSA-8prr-286p-4w7j , PYSEC-2026-2341
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.
Patch / fix
- pypi alerta-server 9.1.0
- alerta_project alerta 9.1.0
- github.com/alerta/alerta@aeba85a commit
- github.com/alerta/alerta@fdd52cd commit
- github.com/alerta/alerta#2040 pull request
- github.com/alerta/alerta#712 pull request
- github.com/alerta/alerta/releases/tag/v9.1.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | alerta-server | <9.1.0 |
9.1.0 |
Affected products
- alerta alerta
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/alerta/alerta/pull/2040
web, issue-tracking, patch
-
github.com
/alerta/alerta/pull/712
web, issue-tracking, patch
-
github.com
/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00
web, patch
-
github.com
/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883
web, patch
-
github.com
/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j
web, vendor-advisory
-
github.com
/alerta/alerta/releases/tag/v9.1.0
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-34400
advisory
-
github.com
/alerta/alerta
package
-
pypi.org
/project/alerta-server
package
-
github.com
/advisories/GHSA-8prr-286p-4w7j
advisory
Sources
- CVE List CVE-2026-34400
- GitHub Advisory GHSA-8prr-286p-4w7j
- NVD CVE-2026-34400
- OSV PYSEC-2026-2341
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.