CVE-2026-34400

CriticalCVSS 9.8

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

Alerta versions prior to 9.1.0 contain a SQL injection vulnerability in the Query string search API (q=). The query is built by directly interpolating user-supplied search terms into SQL strings via f-strings, allowing manipulation of the query.

Risk Assessment

An attacker can exploit this vulnerability to read, modify, or delete data in the Postgres database, potentially compromising the confidentiality and integrity of data monitored by Alerta.

Recommendation

Upgrade Alerta to version 9.1.0, which includes a fix for the SQL injection vulnerability.

Original NVD description (English source)

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.