Junglewise Threat Intelligence

CVE-2026-40906: ElectricSQL SQL injection in /v1/shape API order_by parameter

CVE-2026-40906 · Severity: critical · CVSS 9.9 · Published 2026-04-21

Technologies: Red Hat Developer Hub. Vendors: Red Hat.

Executive brief

Electric is a synchronization engine that connects PostgreSQL databases to local applications. A security flaw in its API allows any logged-in user to execute unauthorized database commands by sending a specially crafted request. This could allow an attacker to read sensitive customer data, modify or delete records, and potentially take full control of the underlying database server.

Technical details

An error-based SQL injection vulnerability exists in the ElectricSQL sync-service due to improper validation of the 'order_by' parameter in the /v1/shape API. The 'Parser.validate_order_by' function utilized a permissive wildcard catch-all in its AST walker, allowing arbitrary SQL expressions (such as SubLink, FuncCall, and TypeCast) to be concatenated directly into the final PostgreSQL query. Attackers can leverage this to extract data via error messages (e.g., using CAST), execute arbitrary DML/DDL via 'dblink_exec', or cause a denial of service. The vulnerability is fixed in version 1.5.0 by implementing a deny-by-default allowlist for AST nodes and rebuilding the SQL clause from the validated AST using 'PgQuery.protobuf_to_query/1'.

Affected products

  • ElectricSQL Electric >= 1.1.12, < 1.5.0
  • Red Hat Red Hat Developer Hub 1

Timeline

  • 2025-10-02: other: Vulnerable code introduced in version 1.1.12
  • 2026-04-02: disclosed: Vulnerability reported by Casco
  • 2026-04-02: patched: Version 1.5.0 released and deployed to Cloud instances
  • 2026-04-21: advisory: CVE-2026-40906 published

References

Related threats