Read the docs
TI-2024-26803 Aliases CVE-2024-39909GHSA-5248-h45p-9pgw

SQL Injection in the KubeClarity REST API

Priority MEDIUM 62CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed kubeclarity (openclarity): 2.23.1github.com/openclarity/kubeclarity/backend (Go): 0.0.0-20240711173334-1d1178840703

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openclaritykubeclaritybefore 2.23.12.23.1Patch availableCNA
—github.com/openclarity/kubeclarity/backend (Go)before 0.0.0-20240711173334-1d11788407030.0.0-20240711173334-1d1178840703Patch availableGHSA-5248-h45p-9pgw
  • kubeclarity Vendoropenclarity Affected before 2.23.1 Fixed in 2.23.1 Patch available CNA
  • github.com/openclarity/kubeclarity/backend (Go) Vendor— Affected before 0.0.0-20240711173334-1d1178840703 Fixed in 0.0.0-20240711173334-1d1178840703 Patch available GHSA-5248-h45p-9pgw

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:openclarity:kubeclarity:*:*:*:*:*:*:*:*——openclarity
  • cpe:2.3:a:openclarity:kubeclarity:*:*:*:*:*:*:*:* Versions — — ·openclarity

Remediation

  • Fix · CNA kubeclarity (openclarity) Fixed in 2.23.1
  • Fix · GHSA-5248-h45p-9pgw github.com/openclarity/kubeclarity/backend (Go) Fixed in 0.0.0-20240711173334-1d1178840703 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-39909
  2. 2026-10-03 Alias added: GHSA-5248-h45p-9pgw

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences