CVE-2026-34400 Details
Description
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.
A SQL injection vulnerability has been identified in the Alerta Query string search API (prior to version 9.1.0). The issue arises in the Postgres query parser, which constructed WHERE clauses by directly interpolating user-supplied search terms into SQL strings using f-strings. This flaw allowed for malicious SQL injection through the 'q=' query parameter. The vulnerability has been patched in version 9.1.0, where the Postgres query parser now employs parameterized queries to prevent such injections.
Users are advised to upgrade to Alerta version 9.1.0 or later. If an upgrade is not possible, consider deploying a proxy in front of the Alerta API to sanitize the 'q=' parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| alerta project alerta | < 9.1.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 3, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |