Junglewise Threat Intelligence

CVE-2026-34400: Alerta SQL injection in Postgres query parser via search API

CVE-2026-34400 · Severity: critical · CVSS 9.8 · Published 2026-03-31

Vendors: PyPI.

Executive brief

Alerta, a monitoring tool used to consolidate and visualize alerts from multiple systems, is vulnerable to a critical security flaw in its search functionality. An attacker can use specially crafted search queries to interfere with the underlying database, potentially leading to the theft of sensitive monitoring data or unauthorized modification of records. This issue affects all versions prior to 9.1.0 and can be exploited remotely without any user interaction.

Technical details

A SQL injection vulnerability exists in Alerta's Postgres query parser. The root cause is the use of Python f-strings to interpolate user-supplied search terms directly into SQL WHERE clauses, rather than using parameterized queries. An attacker can exploit this by sending a crafted string to the `q=` query parameter in the search API. This allows for full database compromise, including data exfiltration and modification. The vulnerability was addressed in version 9.1.0 by implementing a query tree that produces SQL with placeholders and a corresponding parameters dictionary for safe execution.

Affected products

  • Alerta Alerta < 9.1.0

Timeline

  • 2026-03-27: patched: Fix committed to repository
  • 2026-03-31: disclosed: CVE-2026-34400 published

References

Related threats