CVE-2026-71276
Received Received - Intake

SQL Injection in Magistrala Message-Readers API

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description
Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-10
Generated
2026-08-25
AI Q&A
2026-08-05
EPSS Evaluated
2026-08-24
NVD
CVE-2026-71276
EUVD
EUVD-2026-53361

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
absmach magistrala *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in Magistrala's message-readers API. It occurs because the API reads a 'format' value from the HTTP query string without validation and directly inserts it into raw SQL queries using fmt.Sprintf(). This allows authenticated users to manipulate SQL commands by injecting malicious input.

Detection Guidance

To detect this SQL injection vulnerability in Magistrala's message-readers API, inspect HTTP requests to the readers API endpoints for unsanitized 'format' query parameters in SQL queries. Check logs for malformed SQL syntax errors or unexpected database responses. Use tools like SQLMap to test for injection by sending crafted 'format' values such as 'messages%20WHERE%201=1--' in query strings.

Commands to check: 1) Review API logs for queries containing 'fmt.Sprintf' or direct 'format' parameter usage. 2) Use curl to send test requests like 'curl -X GET "http://<host>/readers/messages?format=messages WHERE 1=1--"' and observe responses.

Impact Analysis

An attacker could exploit this to read, modify, or delete sensitive data in the database, bypass authentication, or execute administrative operations. Since the flaw requires authentication, it primarily affects users with legitimate but limited access who can query channel messages.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using Magistrala may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Magistrala to the latest patched version that validates and sanitizes the 'format' parameter. If a patch is unavailable, disable the affected API endpoints or restrict access to authenticated users with minimal privileges. Implement input validation to reject any 'format' values containing SQL syntax or special characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart