PT-2026-25077 · Anchore · Anchore Enterprise

Andrew Van Fleteren · Published 2026-03-12 · Updated 2026-03-14 · CVE-2026-25076

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Anchore Enterprise versions prior to 5.25.1

Description Anchore Enterprise is affected by an SQL injection issue in the GraphQL Reports API. An authenticated attacker with access to the GraphQL API can execute arbitrary SQL instructions, potentially modifying data within the Anchore Enterprise database. The vulnerable API endpoint is the GraphQL Reports API.

Recommendations Update Anchore Enterprise to version 5.25.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25076

Affected Products

Anchore Enterprise

References · 7

• https://docs.anchore.com/current/docs/release_notes/enterprise/5251 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25076 · Security Note
• https://t.me/CVEtracker/47292 · Telegram Post
• https://twitter.com/CVEnew/status/2032230648165859682 · Twitter Post
• https://anchore.com/platform · Note
• https://twitter.com/EdgeDetectOps/status/2032751188815335595 · Twitter Post
• https://vulncheck.com/advisories/anchore-enterprise-graphql-reports-api-sql-injection · Note