CVE-2026-82028
HighCVSS 8.8Summary
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services, allowing authenticated attackers to inject arbitrary SQL via the format parameter.
Risk Assessment
An attacker with a self-registered account can read cross-tenant data, extract password hashes, read/write files, and execute code as the postgres user, leading to full database compromise.
Recommendation
Update Magistrala to version 1.0.0 or later, which includes fixes for SQL injection.
Other vulnerabilities in Magistrala
See all- CVE-2026-71276High
Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.
- CVE-2026-71235High
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side. The Lua engine performs no input validation and preloads dangerous libraries enabling arbitrary code execution, DB access, file I/O, SSRF, and path traversal.
Original NVD description (English source)
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without parameterization or identifier quoting. Attackers with a self-registered account can substitute arbitrary subqueries to achieve cross-tenant database reads, extract pg_shadow password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects, with all injected SQL executing at superuser privilege due to the default PostgreSQL role configuration.