CVE-2026-8339
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A SQL injection vulnerability in Coverity Connect SOAP API for versions 2024.6.0 through 2026.3.0. An authenticated attacker can send a crafted payload to achieve full read access to the database and execute unauthorized commands.
Risk Assessment
An attacker can read all database data and execute unauthorized operations, leading to serious confidentiality and integrity breaches.
Recommendation
Update Coverity Connect to a version later than 2026.3.0.
Other vulnerabilities in Coverity Connect
See all- CVE-2026-8338Critical
Coverity Connect versions between 2023.6.0 and 2026.3.0 have a Spring Security authentication and authorization bypass vulnerability. An unauthenticated attacker can send a crafted HTTP request to access data within Coverity.
- CVE-2026-1496Critical
Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling, making it vulnerable to an authentication bypass. An attacker with access to the /token API endpoint who knows or guesses a valid username can use a specially crafted HTTP request to bypass authentication and assume all roles and privileges of the valid user's account.
Original NVD description (English source)
A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands.