# CVE-2026-41457: OwnTone Server SQL injection in DAAP query and filter parameters

Source: https://junglewise.ai/threats/cve-2026-41457-owntone-server-sql-injection-in-daap-query-and-filter-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-41457 · Severity: info · CVSS 6.9 · Published 2026-04-22

OwnTone Server, a Linux-based media server for iTunes and Spotify streaming, is vulnerable to a security flaw in how it handles media library searches. An attacker can send specially crafted search or filter requests to bypass security restrictions and gain unauthorized access to the server's media database. This could allow an unauthorized user to view or extract information about the media library that they should not be able to see.

Technologies: [OwnTone Server](https://junglewise.ai/threats/technologies/owntone-server). Vendors: [OwnTone](https://junglewise.ai/threats/vendors/owntone).

## Quick answers

**Is CVE-2026-41457 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41457 being exploited in the wild.

**How severe is CVE-2026-41457?** Informational severity, with a CVSS score of 6.9, published 22 April 2026.

**Which products and versions are affected?** OwnTone Server 28.4 through 29.0.

**Is there a fix for CVE-2026-41457?** A patch was published on 2026-04-21: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41457 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41457?** Check whether you run OwnTone Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in OwnTone Server's DAAP (Digital Audio Access Protocol) parser, specifically within the handling of integer-mapped fields in the 'query=' and 'filter=' parameters. The root cause is insufficient sanitization of user-supplied input in 'src/parsers/daap_parser.y', where values were appended directly to SQL queries without validation. A remote, unauthenticated attacker can exploit this by supplying malicious SQL expressions in place of expected integer values to bypass filters or access unauthorized media library data. The issue is resolved in version 29.1 by implementing proper integer conversion using 'strtoll' before query construction.

## Affected products

- OwnTone OwnTone Server 28.4 through 29.0

## Timeline

- 2026-04-21: advisory: Initial advisory published by VulnCheck
- 2026-04-22: disclosed: CVE published to NVD
- 2026-04-21: patched: Fix committed to GitHub repository

## References

- [https://github.com/owntone/owntone-server/commit/d4784ebf2099ed1a4203333aee957e5c7553c217](https://github.com/owntone/owntone-server/commit/d4784ebf2099ed1a4203333aee957e5c7553c217)
- [https://www.vulncheck.com/advisories/owntone-server-sql-injection-via-query-and-filter-parameters](https://www.vulncheck.com/advisories/owntone-server-sql-injection-via-query-and-filter-parameters)

## Related threats

- [OwnTone Server SQL injection in mpd_sticker_find()](https://junglewise.ai/threats/cve-2026-120441-owntone-server-through-29-3-contains-an-sql-injection)
- [OwnTone Server race condition in DAAP login handler](https://junglewise.ai/threats/cve-2026-41458-owntone-server-race-condition-in-daap-login-handler)