PT-2026-29356 · Alerta · Alerta

Satterly · Publicado 2026-03-31 · Atualizado 2026-04-01 · CVE-2026-34400

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alerta versions prior to 9.1.0

Description Alerta, a monitoring tool, had a SQL injection issue in the Query string search API. The vulnerability stemmed from directly interpolating user-supplied search terms into SQL strings via f-strings when building WHERE clauses using the Postgres query parser. The API endpoint ''/'' with the q parameter was susceptible to this issue.

Recommendations Upgrade to version 9.1.0 or later. If an upgrade is not possible, deploy a proxy to sanitize the q parameter before it reaches the Alerta API.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-34400

GHSA-8PRR-286P-4W7J

Produtos afetados

Alerta

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34400.json · Exploit
• https://github.com/alerta/alerta/pull/2040 · Correção
• https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j · Aviso do Fabricante
• https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883 · Correção
• https://github.com/alerta/alerta/releases/tag/v9.1.0 · Nota
• https://github.com/alerta/alerta/pull/712 · Correção
• https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00 · Correção
• https://github.com/alerta/alerta · Nota
• https://osv.dev/vulnerability/GHSA-8prr-286p-4w7j · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34400 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039372113677586916 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-34400 · Nota de Segurança