alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

NGHIÊM TRỌNG 9.8CVE-2026-34400 · GHSA-8prr-286p-4w7j · PYSEC-2026-2341 · Công bố 31/03/2026 · cập nhật 24/07/2026

Tóm tắt nhanh

CVE-2026-34400 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng alerta-server, alerta (alerta project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.53%, cao hơn 44.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.1.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
alerta-server PyPI	`< 9.1.0`	`9.1.0`
alerta alerta_project	`< 9.1.0`	`9.1.0`

Mô tả

Impact

The Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings.

Patches

Fixed in v9.1.0. The Postgres query parser now uses parameterized queries with %(name)s placeholders passed to psycopg2's cursor.execute(), preventing SQL injection through the ?q= parameter. The MongoDB backend was not affected.

Workarounds

Upgrade to v9.1.0 or later. If unable to upgrade, deploy a proxy in front of the Alerta API to sanitize the q= parameter.

Resources

https://github.com/alerta/alerta/pull/712/files https://owasp.org/www-community/attacks/SQL_Injection

Mô tả của NVD

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.