Read the docs
TI-2024-23256 Aliases CVE-2024-35182GHSA-h7cm-jvpp-69xf

GHSL-2024-014 Meshery SQL Injection vulnerability

Priority HIGH 68CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput` function.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01565 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed meshery (meshery): 0.7.22github.com/layer5io/meshery (Go): 0.7.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mesherymesherybefore 0.7.220.7.22Patch availableCNA
—github.com/layer5io/meshery (Go)before 0.7.220.7.22Patch availableGHSA-h7cm-jvpp-69xf
  • meshery Vendormeshery Affected before 0.7.22 Fixed in 0.7.22 Patch available CNA
  • github.com/layer5io/meshery (Go) Vendor— Affected before 0.7.22 Fixed in 0.7.22 Patch available GHSA-h7cm-jvpp-69xf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:layer5:meshery:*:*:*:*:*:*:*:*before 0.7.22Vulnerablemeshery
  • cpe:2.3:a:layer5:meshery:*:*:*:*:*:*:*:* Versions before 0.7.22 Vulnerable ·meshery

Remediation

  • Fix · CNA meshery (meshery) Fixed in 0.7.22
  • Fix · GHSA-h7cm-jvpp-69xf github.com/layer5io/meshery (Go) Fixed in 0.7.22 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35182
  2. 2026-10-03 Alias added: GHSA-h7cm-jvpp-69xf

References

Exploit 1

Patch 2

Advisory 2

Other 3

  • TI-2024-24304 Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and… CVSS 3.1CRITICAL 9.8
  • TI-2021-11849 A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker… CVSS 3.1CRITICAL 9.8
  • TI-2024-19213 Meshery SQL Injection vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-25091 A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a… CVSS 3.1CRITICAL 9.8
  • TI-2024-23255 GHSL-2024-013 Meshery SQL Injection vulnerability CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences