CVE-2026-82028 Details

A SQL injection vulnerability has been identified in Magistrala versions prior to 1.0.0, specifically within the timescale-reader and postgres-reader HTTP API services. This vulnerability allows authenticated attackers to inject arbitrary SQL by manipulating the format query parameter, which is directly interpolated into the FROM clause without proper parameterization or identifier quoting. Attackers with self-registered accounts can exploit this to perform cross-tenant database reads, extract pg_shadow password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects. All injected SQL executes with superuser privileges, exploiting the default PostgreSQL role configuration.

Users are advised to update to Magistrala version 1.0.0 or later, where this vulnerability has been addressed.