CVE-2026-34400

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-34400
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00 Patch
https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883 Patch
https://github.com/alerta/alerta/pull/2040 Issue Tracking Patch
https://github.com/alerta/alerta/pull/712 Issue Tracking Patch
https://github.com/alerta/alerta/releases/tag/v9.1.0 Product Release Notes
https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*
History

10 Apr 2026, 01:41

Type Values Removed Values Added
First Time Alerta Project alerta
Alerta Project
CPE cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*
References () https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00 - () https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00 - Patch
References () https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883 - () https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883 - Patch
References () https://github.com/alerta/alerta/pull/2040 - () https://github.com/alerta/alerta/pull/2040 - Issue Tracking, Patch
References () https://github.com/alerta/alerta/pull/712 - () https://github.com/alerta/alerta/pull/712 - Issue Tracking, Patch
References () https://github.com/alerta/alerta/releases/tag/v9.1.0 - () https://github.com/alerta/alerta/releases/tag/v9.1.0 - Product, Release Notes
References () https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j - () https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j - Vendor Advisory

03 Apr 2026, 17:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

31 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-31 22:16

Updated : 2026-04-10 01:41

NVD link : CVE-2026-34400

Mitre link : CVE-2026-34400

CVE.ORG link : CVE-2026-34400

JSON object : View

Products Affected

alerta_project

  • alerta
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')