PT-2026-29356 · Alerta · Alerta

Satterly · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34400

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alerta versions prior to 9.1.0

Description Alerta, a monitoring tool, had a SQL injection issue in the Query string search API. The vulnerability stemmed from directly interpolating user-supplied search terms into SQL strings via f-strings when building WHERE clauses using the Postgres query parser. The API endpoint ''/'' with the q parameter was susceptible to this issue.

Recommendations Upgrade to version 9.1.0 or later. If an upgrade is not possible, deploy a proxy to sanitize the q parameter before it reaches the Alerta API.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-34400

GHSA-8PRR-286P-4W7J

Affected Products

Alerta

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34400.json · Exploit
• https://github.com/alerta/alerta/pull/2040 · Patch
• https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j · Vendor Advisory
• https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883 · Patch
• https://github.com/alerta/alerta/pull/712 · Patch
• https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00 · Patch
• https://osv.dev/vulnerability/GHSA-8prr-286p-4w7j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34400 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34400 · Security Note
• https://github.com/alerta/alerta/releases/tag/v9.1.0 · Note
• https://github.com/alerta/alerta · Note
• https://twitter.com/CVEnew/status/2039372113677586916 · Twitter Post