CVE-2026-19926
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A SQL injection vulnerability has been found in Evergreen up to versions 3.14.11/3.15.11/3.16.5/3.17-beta1. It affects an unknown function in the file /osrf-gateway-v1 of the open-ils.fielder OpenSRF Service component. The attack can be executed remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can exploit SQL injection to read, modify, or delete data in the database, potentially leading to data integrity compromise and system takeover.
Recommendation
Upgrade Evergreen to version 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2, which contain the fix. Additionally, restrict access to the OpenSRF service.
Original NVD description (English source)
A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded.