PT-2026-34579 · Rocket.Chat · Rocket.Chat

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-29198

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.3.0 Rocket.Chat versions prior to 8.2.1 Rocket.Chat versions prior to 8.1.2 Rocket.Chat versions prior to 8.0.3 Rocket.Chat versions prior to 7.13.5 Rocket.Chat versions prior to 7.12.6 Rocket.Chat versions prior to 7.11.6 Rocket.Chat versions prior to 7.10.9

Description A NoSQL injection—a technique where an attacker uses specially crafted queries to manipulate a NoSQL database—can lead to account takeover of the first user with a generated token when an OAuth app is configured.

Recommendations Update to version 8.3.0 Update to version 8.2.1 Update to version 8.1.2 Update to version 8.0.3 Update to version 7.13.5 Update to version 7.12.6 Update to version 7.11.6 Update to version 7.10.9

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-29198

Affected Products

Rocket.Chat

References · 4

• https://github.com/RocketChat/Rocket.Chat/pull/39492 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-29198 · Security Note
• https://twitter.com/CVEnew/status/2047359921390235876 · Twitter Post
• https://hackerone.com/reports/3564655 · Note