Read the docs
TI-2026-56613 Aliases CVE-2026-82028GHSA-9m8c-pc28-w7mx

Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without parameterization or identifier quoting. Attackers with a self-registered account can substitute arbitrary subqueries to achieve cross-tenant database reads, extract pg_shadow password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects, with all injected SQL executing at superuser privilege due to the default PostgreSQL role configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Fix Fixed magistrala (absmach): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
absmachmagistralabefore 1.0.01.0.0Patch availableCNA
  • magistrala Vendorabsmach Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA

Remediation

  • Fix · CNA magistrala (absmach) Fixed in 1.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82028
  2. 2026-10-03 Alias added: GHSA-9m8c-pc28-w7mx

References

Patch 2

Other 1

  • TI-2026-75470 Authorization bypass in Magistrala certs service CVSS 4.0HIGH 7.2
  • TI-2026-49906 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine CVSS 3.1HIGH 8.8
  • TI-2026-49943 Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences