alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

緊急 9.8CVE-2026-34400 · GHSA-8prr-286p-4w7j · PYSEC-2026-2341 · 31/03/2026 公開 · 24/07/2026 更新

要点

CVE-2026-34400 は alerta-server, alerta (alerta project) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.53%（全脆弱性の 44.5% より高い）。
対処：9.1.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
alerta-server PyPI	`< 9.1.0`	`9.1.0`
alerta alerta_project	`< 9.1.0`	`9.1.0`

概要

Impact

The Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings.

Patches

Fixed in v9.1.0. The Postgres query parser now uses parameterized queries with %(name)s placeholders passed to psycopg2's cursor.execute(), preventing SQL injection through the ?q= parameter. The MongoDB backend was not affected.

Workarounds

Upgrade to v9.1.0 or later. If unable to upgrade, deploy a proxy in front of the Alerta API to sanitize the q= parameter.

Resources

https://github.com/alerta/alerta/pull/712/files https://owasp.org/www-community/attacks/SQL_Injection

NVD の説明

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.