CVE-2026-71276

7.1 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows SQL injection by authenticated users due to direct interpolation of unvalidated HTTP query string values into raw SQL queries.
Exploitability: Exploitation requires an authenticated user with permission to query channel messages, making it moderately difficult.
Blast radius: If exploited, the impact could be high, potentially leading to full database compromise for affected systems.
Prioritized remediation: Validate and sanitize all input before using it in SQL queries to prevent SQL injection attacks.

rcesql-injectionwebauth-required

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weaknesses

CWE-89

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.