CVE-2026-57230
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in OpenReplay before version 1.27.0 allows an authenticated user to read any ClickHouse table via SQL injection in the session search and analytics API. The attacker can perform blind boolean and time-based data exfiltration and disrupt session search for all users.
Risk Assessment
The risk includes unauthorized access to sensitive data stored in ClickHouse and disruption of session search functionality, potentially impacting session monitoring and analysis continuity.
Recommendation
Upgrade OpenReplay to version 1.27.0 or later immediately, which fixes the SQL injection vulnerability.
Other vulnerabilities in OpenReplay
See all- CVE-2026-55879Critical
OpenReplay versions 1.24.0 through 1.25.0 contain an XSS vulnerability allowing an unauthenticated attacker to take over a dashboard account. The attacker can inject a malicious script via custom event names or captured page URLs, which are stored in ClickHouse without output encoding and later rendered in the dashboard, enabling theft of the JWT token from localStorage.
- CVE-2026-55881High
A vulnerability in OpenReplay allows an authenticated low-privilege user to read the first 15 seconds of session replay data from another tenant. The issue stems from missing validation that the session belongs to the project when generating presigned download URLs.
- CVE-2026-55880High
In OpenReplay versions 1.27.0 and earlier, three mutation functions (notes.delete, dashboards.update_widget, dashboards.remove_widget) did not check resource ownership, allowing any authenticated user to delete other users' private session notes and modify widgets on their private dashboards.
Original NVD description (English source)
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.