CVE-2026-34400: alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
(updated )
The Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings.
References
- github.com/advisories/GHSA-8prr-286p-4w7j
- github.com/alerta/alerta
- github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00
- github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883
- github.com/alerta/alerta/pull/2040
- github.com/alerta/alerta/pull/712
- github.com/alerta/alerta/releases/tag/v9.1.0
- github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j
- nvd.nist.gov/vuln/detail/CVE-2026-34400
Code Behaviors & Features
Detect and mitigate CVE-2026-34400 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →