CVE-2026-1207 in the critical feed json
Potential SQL injection via raster lookups on PostGIS
published 2026-02-03 9 mo ago modified 2026-09-10 59 d ago also BIT-django-2026-1207 , EUVD-2026-5253 , GHSA-mwm9-4648-f68q , PYSEC-2026-44
- cvss
- 8.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 12.8%
- EPSS 12.8% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
Patch / fix
- pypi django 4.2.28, 5.2.11, 6.0.2
- bitnami django 4.2.28, 5.2.11, 6.0.2
- djangoproject Django 4.2.28, 5.2.11, 6.0.2
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.2.28-1.el8ap
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.2.28-1.el9ap
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.2.28-1.el9ap
- Red Hat Red Hat Satellite 6.16 for RHEL 8 0:4.2.28-0.1.el8pc
- Red Hat Red Hat Satellite 6.16 for RHEL 9 0:4.2.28-0.1.el9pc
- Red Hat Red Hat Satellite 6.17 for RHEL 9 0:0.0.3-4.el9sat, 0:0.1.23-0.3.el9pc, 0:0.4.3-1.el9sat, 0:0.13.0-1.el9sat, 0:1.2.0-0.1.el9pc, 0:1.5.1-1.el9sat, 0:2.22.3-1.el9pc, 0:3.14.0.14-1.el9sat, 0:3.27.10-2.el9pc, 0:4.2.28-0.1.el9pc, 0:4.16.0.14-1.el9sat, 0:6.17.7-1.el9sat
- Red Hat Red Hat Satellite 6.18 for RHEL 9 0:4.2.30-1.el9pc
- Red Hat Red Hat Ansible Automation Platform 2.5 1772214630
- Red Hat Red Hat Ansible Automation Platform 2.6 1772552788
- Red Hat Red Hat Discovery 2 1770913597
- Red Hat Red Hat Satellite 6.18 1773451075
- python-django Debian 12 3:3.2.25-0+deb12u2
- python-django Debian 13 3:4.2.28-0+deb13u1
- python-django Debian 14 3:4.2.28-1
debian advisories DEBIAN-CVE-2026-1207
- python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.25
- python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.14
- python-django Ubuntu 25.10 3:5.2.4-1ubuntu2.3
- python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm14
- python-django Ubuntu Pro 20.04 LTS 2:2.2.12-1ubuntu0.29+esm7
ubuntu advisories UBUNTU-CVE-2026-1207
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python3.12-django satellite capsule 6.18, satellite 6.18 4.2.30-1.el9pc
- python3.12-markdown satellite capsule 6.18, satellite 6.18 3.8.2-1.el9pc
- python3.12-pyOpenSSL satellite capsule 6.18, satellite 6.18 26.0.0-2.el9pc
- rubygem-activesupport satellite capsule 6.18, satellite 6.18 7.0.8.7-2.el9sat
- foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el8sat
- foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el9sat
- foreman-cli satellite utils 6.16, satellite 6.16 3.12.0.14-1.el8sat
- foreman-cli satellite utils 6.16, satellite 6.16 3.12.0.14-1.el9sat
red hat advisories RHSA-2026:14835RHSA-2026:5971RHSA-2026:5970RHSA-2026:3959RHSA-2026:3958
- python-Django SLE Module for Package Hub 15 SP7, openSUSE Leap 15.6 4.2.11-150600.3.47.1
suse advisories SUSE-SU-2026:0440-1
- python-Django5 openSUSE Tumbleweed 5.2.16-1.1
- python-Django4 openSUSE Tumbleweed 4.2.28-1.1
- python-Django openSUSE Leap 16.0 5.2.4-bp160.5.1
- python-Django openSUSE Tumbleweed 5.2.11-1.1
- python-Django6 openSUSE Tumbleweed 6.0.2-1.1
opensuse advisories openSUSE-SU-2026:11270-1openSUSE-SU-2026:10247-1openSUSE-SU-2026:20184-1openSUSE-SU-2026:10160-1openSUSE-SU-2026:10145-1
- py3-django Alpine 3.24, Alpine 3.23 4.2.28-r0
alpine advisories ALPINE-CVE-2026-1207
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-1207 updated cvss 8.3
Django: Django: SQL Injection via RasterField band index parameter
-
Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-24/lightspeed-rhel8affected: workaround, no fix planned “Will not fix”
-
Red Hat Satellite 6 python-django, python2-django, python-django-bash-completionaffected: workaround, no fix available
-
Red Hat Update Infrastructure 4 for Cloud Providers python-djangoaffected: workaround, no fix planned “Will not fix”
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25 1772214630fixed: vendor fix RHSA-2026:3962
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-django 4.2.28-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-django 4.2.28-1.el9apfixed: vendor fix RHSA-2026:3959
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1772552788fixed: vendor fix RHSA-2026:3960
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-django 4.2.28-1.el9apfixed: vendor fix RHSA-2026:3958
-
Red Hat Discovery 2 discovery 1770913597fixed: vendor fix RHSA-2026:2694
show 7 moreshow fewer
-
Red Hat Satellite 6.16 for RHEL 8 python-django 4.2.28-0.1.el8pc, python3.11-django 4.2.28-0.1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-django 4.2.28-0.1.el9pc, python3.11-django 4.2.28-0.1.el9pcfixed: vendor fix RHSA-2026:5971
-
Red Hat Satellite 6.17 for RHEL 9 libcomps 0.1.23-0.3.el9pc, satellite 6.17.7-1.el9sat, foreman 3.14.0.14-1.el9sat, python-brotli 1.2.0-0.1.el9pc, satellite-cli 6.17.7-1.el9sat, foreman-cli 3.14.0.14-1.el9sat, +29 morefixed: vendor fix RHSA-2026:5970
-
Red Hat Satellite 6.18 satellite 1773451075fixed: vendor fix RHSA-2026:6291
-
Red Hat Satellite 6.18 for RHEL 9 python3.12-django 4.2.30-1.el9pcfixed: vendor fix RHSA-2026:14835
-
Red Hat Ansible Automation Platform 2 python-django, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-25/de-minimal-rhel8, ansible-automation-platform-25/de-minimal-rhel9, ansible-automation-platform-26/de-minimal-rhel9 Red Hat Ansible Automation Platform 2.5 ansible-automation-platform 1772612626, ansible-automation-platform 1772612732, ansible-automation-platform-25 1771955148, ansible-automation-platform-25 1772382294, ansible-automation-platform-25 1772382310, ansible-automation-platform-25 1772382340, +21 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 tox 4.15.1-2.el8ap, uwsgi 2.0.28-2.el8ap, bindep 2.13.0-2.el8ap, receptor 1.6.3-4.el8ap, yamllint 1.35.1-2.el8ap, molecule 25.12.0-2.el8ap, +301 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 tox 4.15.1-2.el9ap, uwsgi 2.0.28-2.el9ap, bindep 2.13.0-2.el9ap, receptor 1.6.3-4.el9ap, yamllint 1.35.1-2.el9ap, molecule 25.12.0-2.el9ap, +298 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform 1772556678, ansible-automation-platform 1772556679, ansible-automation-platform-26 1772204398, ansible-automation-platform-26 1772381996, ansible-automation-platform-26 1772382003, ansible-automation-platform-26 1772382254, +21 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 tox 4.15.1-2.el9ap, uwsgi 2.0.28-2.el9ap, bindep 2.13.0-2.el9ap, receptor 1.6.3-4.el9ap, yamllint 1.35.1-2.el9ap, molecule 25.12.0-2.el9ap, +332 morenot affected: vulnerable code not present
+2 more productsfewer
Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.3-4.el10ap, receptorctl 1.6.3-4.el10ap, ansible-core 2.16.16-2.el10ap, python-django 4.2.28-2.el10ap, python3-django 4.2.28-2.el10ap Red Hat Discovery 2 discovery 1770913709 -
Red Hat OpenStack Platform 16.2 python-django20, python3-django20, python-django20-bash-completion Red Hat OpenStack Platform 17.1 python-django, python3-django Red Hat OpenStack Platform 18.0 python-djangonot affected: vulnerable code not in execute path
-
Red Hat Satellite 6.16 for RHEL 8 libcomps 0.1.23-0.1.el8pc, satellite 6.16.7-1.el8sat, foreman 3.12.0.14-1.el8sat, python-brotli 1.2.0-0.1.el8pc, satellite-cli 6.16.7-1.el8sat, foreman-cli 3.12.0.14-1.el8sat, +25 more Red Hat Satellite 6.16 for RHEL 9 libcomps 0.1.23-0.1.el9pc, satellite 6.16.7-1.el9sat, foreman 3.12.0.14-1.el9sat, python-brotli 1.2.0-0.1.el9pc, satellite-cli 6.16.7-1.el9sat, foreman-cli 3.12.0.14-1.el9sat, +25 more Red Hat Satellite 6.18 for RHEL 9 candlepin 4.6.5-1.el9sat, satellite 6.18.5-1.el9sat, foreman 3.16.0.16-1.el9sat, python3.12-cffi 2.0.0-1.el9pc, satellite-cli 6.18.5-1.el9sat, foreman-cli 3.16.0.16-1.el9sat, +27 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
12.82% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Django RasterField - SQL Injection nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CISA ADP | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| OSV | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | >=6.0a1, <6.0.2 >=5.2a1, <5.2.11 >=4.2a1, <4.2.28 >=4.2, <4.2.28 >=5.2, <5.2.11 >=6.0, <6.0.2 |
6.0.2 5.2.11 4.2.28 |
| bitnami | django | >=4.2.0, <4.2.28 >=5.2.0, <5.2.11 >=6.0.0, <6.0.2 |
4.2.28 5.2.11 6.0.2 |
Affected products
- djangoproject Django
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Red Hat Satellite 6.16 for RHEL 8
- Red Hat Red Hat Satellite 6.16 for RHEL 9
- Red Hat Red Hat Satellite 6.17 for RHEL 9
- Red Hat Red Hat Satellite 6.18 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.5
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat Discovery 2
- Red Hat Red Hat Satellite 6.18
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat OpenStack Platform 16.2
- Red Hat Red Hat OpenStack Platform 17.1
- Red Hat Red Hat OpenStack Platform 18.0
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Update Infrastructure 4 for Cloud Providers
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
- Technology feeds
References
-
docs.djangoproject.com
/en/dev/releases/security/
vendor-advisory, patch, advisory
-
djangoproject.com
/weblog/2026/feb/03/security-releases/
vendor-advisory, patch, advisory
-
github.com
/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8
web
-
access.redhat.com
/errata/RHSA-2026:3959
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:5971
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:3958
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:5970
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:14835
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:3962
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:3960
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2694
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:6291
vendor-advisory, web
-
groups.google.com
/g/django-announce
mailing-list, web, release-notes, article, advisory
-
access.redhat.com
/security/cve/CVE-2026-1207
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2436338
issue-tracking, web
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-1207.json
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-1207
advisory, web
-
docs.djangoproject.com
/en/dev/releases/security
web
-
github.com
/django/django
package
-
github.com
/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-44.yaml
web
-
djangoproject.com
/weblog/2026/feb/03/security-releases
web
-
github.com
/advisories/GHSA-mwm9-4648-f68q
advisory
Sources
- CVE List CVE-2026-1207
- GitHub Advisory GHSA-mwm9-4648-f68q
- NVD CVE-2026-1207
- OSV BIT-django-2026-1207
- OSV PYSEC-2026-44
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.