CVE-2026-71276 PUBLISHED

Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter

Assigner: TuranSec
Reserved: 05.08.2026 Published: 05.08.2026 Updated: 05.08.2026

Magistrala (formerly Mainflux)'s message-readers API reads a format value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf() in both the PostgreSQL reader (readers/postgres/messages.go: fmt.Sprintf("SELECT * FROM %s WHERE %s ...", format, cond)) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS Score: 7.1

Product Status

Vendor absmach
Product magistrala
Versions Default: unaffected
  • affected from 0 to * (incl.)

Credits

  • Alibek Baxtiyorov finder

References

Problem Types

  • CWE-89 CWE