CVE-2026-57190
Received Received - Intake

SQL Injection in Asterisk via CELGenUserEvent

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-57190
EUVD
EUVD-2026-111401

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
asterisk asterisk < 20.20.1
asterisk asterisk >= 21.0.0-pre1, < 21.12.3
asterisk asterisk >= 22.0.0-pre1, < 22.10.1
asterisk asterisk >= 23.0.0-pre1, < 23.4.1
asterisk certified-asterisk < 20.7-cert11
asterisk certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Asterisk, a telephony toolkit, where the PostgreSQL and TDS/MSSQL Channel Event Log backends may allow arbitrary SQL execution if untrusted data is set in the CEL eventtype column via the CELGenUserEvent dialplan application. Exploitation requires the vulnerable backends to be loaded and configured, and the administrator to call CELGenUserEvent without validating input data.

Detection Guidance

To detect this vulnerability, check if your Asterisk version is affected by running: asterisk -rx 'core show version'. If you are running a version prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11, 22.8-cert3, you are vulnerable.

Impact Analysis

An attacker could execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion in the database. This could compromise sensitive information stored in the Asterisk system, such as call logs or user data.

Compliance Impact

This vulnerability could lead to unauthorized access or manipulation of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and integrity. Organizations using affected Asterisk versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Asterisk to a patched version: 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11, 22.8-cert3. If upgrading is not immediately possible, disable the cel_pgsql or cel_tds backends in Asterisk configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart