CVE-2026-57230
Received Received - Intake

ClickHouse Query Injection in OpenReplay Enterprise

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-57230

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openreplay session_replay_suite to 1.27.0 (exc)
openreplay session_replay_suite 1.27.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenReplay versions prior to 1.27.0 in the enterprise editions with multi-tenancy enabled. The session search and analytics API builds ClickHouse queries by inserting user input directly into the query string without proper escaping in two positions. This allows an authenticated member to exploit the system by performing blind boolean and time-based exfiltration attacks to read any ClickHouse table. Additionally, the attacker can disrupt the project's session search functionality for all viewers until a stored key is removed.

Impact Analysis

The vulnerability can lead to unauthorized data access, allowing an authenticated user to read any data stored in ClickHouse tables, which may include sensitive or confidential information. It also enables attackers to disrupt the session search functionality for all users, potentially impacting the availability and reliability of the service.

Mitigation Strategies

The vulnerability is fixed in OpenReplay version 1.27.0. The immediate step to mitigate this vulnerability is to upgrade your OpenReplay session replay suite to version 1.27.0 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57230. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart