← Database

CVE-2026-34400

CRITICAL CVSS: 9.8 Published: 2026-03-31 Modified: 2026-07-24

Description

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

Affected Platforms

Alerta Project Alerta

Weakness Type

CWE-89

References