Is CVE-2026-28516 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28516 being exploited in the wild.

How severe is CVE-2026-28516?

High severity, with a CVSS score of 8.8, published 27 February 2026.

Which products and versions are affected?

Opendcim through 23.04 (commit 4467e9c4).

Is there a fix for CVE-2026-28516?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28516 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-28516?

Check whether you run Opendcim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28516: openDCIM SQL injection in Config::UpdateParameter

CVE-2026-28516 · Severity: high · CVSS 8.8 · Published 2026-02-27

openDCIM, an open-source tool for managing data center infrastructure, contains a security flaw in its configuration handling. This vulnerability allows an authenticated user to manipulate the underlying database by injecting malicious commands into setup forms. In practice, this can lead to unauthorized access to sensitive data, modification of system settings, or a complete takeover of the application when combined with other flaws.

Technologies: Opendcim. Vendors: Opendcim.

Quick answers

Is CVE-2026-28516 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28516 being exploited in the wild.
How severe is CVE-2026-28516?: High severity, with a CVSS score of 8.8, published 27 February 2026.
Which products and versions are affected?: Opendcim through 23.04 (commit 4467e9c4).
Is there a fix for CVE-2026-28516?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28516 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-28516?: Check whether you run Opendcim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in openDCIM through version 23.04 (commit 4467e9c4) within the Config::UpdateParameter function. The application's install.php and container-install.php handlers process user-supplied LDAP configuration parameters using direct string interpolation into SQL UPDATE statements without sanitization or prepared statements. Because the application uses PDO with MySQL, an attacker can utilize stacked queries to execute arbitrary SQL commands. While the vulnerability typically requires authentication, many Docker-based deployments are configured in a way that makes these endpoints accessible without credentials. This flaw can be chained with other vulnerabilities (like CVE-2026-28517) to achieve remote code execution (RCE).

Affected products

openDCIM openDCIM through 23.04 (commit 4467e9c4)

Timeline

2026-02-26: disclosed: Initial discovery and blog post by Chocapikk
2026-02-27: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.