What is CVE-2026-71276?
CVE-2026-71276 is a SQL injection vulnerability in Magistrala's (formerly Mainflux) message-readers API, where the `format` parameter from HTTP requests is unsafely interpolated into raw SQL queries via `fmt.Sprintf()`. This affects the PostgreSQL reader and could allow unauthorized database access. Mitigation requires proper input validation and sanitization of the `format` parameter.
Azərbaycanca: CVE-2026-71276 Magistrala (keçmiş Mainflux) platformasının message-readers API-sində SQL injection zəifliyidir. HTTP sorğusundan `format` parametri yoxlanılmadan SQL sorğularına daxil edilir, bu da PostgreSQL verilənlər bazasına müdaxiləyə yol aça bilər. Bu zəifliyi aradan qaldırmaq üçün daxil olan məlumatların ciddi şəkildə yoxlanılması tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
In which API of the Magistrala platform was CVE-2026-71276 detected?
The vulnerability was detected in Magistrala's message-readers API.
Which database can an attacker potentially compromise using CVE-2026-71276?
The PostgreSQL database can potentially be compromised.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.