Is CVE-2026-41478 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41478 being exploited in the wild.

How severe is CVE-2026-41478?

Critical severity, with a CVSS score of 9.9, published 24 April 2026.

Which products and versions are affected?

Saltcorn All versions before 1.4.6, 1.5.0-beta.0 through 1.5.5, 1.6.0-alpha.0 through 1.6.0-beta.4.

Is there a fix for CVE-2026-41478?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41478 attacked?

It is attacked over the network.

Am I affected by CVE-2026-41478?

Check whether you run Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41478: Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

CVE-2026-41478 · Severity: critical · CVSS 9.9 · Published 2026-04-24

Saltcorn is an open-source low-code database application platform. A critical SQL injection vulnerability in its mobile synchronization features allows any authenticated user with table read access to execute arbitrary SQL commands, leading to complete database compromise including theft of admin credentials, secrets, and all application data.

Technologies: Saltcorn. Vendors: Saltcorn.

Quick answers

Is CVE-2026-41478 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41478 being exploited in the wild.
How severe is CVE-2026-41478?: Critical severity, with a CVSS score of 9.9, published 24 April 2026.
Which products and versions are affected?: Saltcorn All versions before 1.4.6, 1.5.0-beta.0 through 1.5.5, 1.6.0-alpha.0 through 1.6.0-beta.4.
Is there a fix for CVE-2026-41478?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41478 attacked?: It is attacked over the network.
Am I affected by CVE-2026-41478?: Check whether you run Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a SQL injection flaw (CWE-89) in the mobile-sync routes (/sync/load_changes and /sync/deletes) in packages/server/routes/sync.js. User-controlled values from the request body (specifically req.body.syncInfos[tableName].maxLoadedId and timestamp-derived values) are interpolated directly into SQL template literals without parameterization or proper validation. While db.sqlsanitize() is used for identifier escaping, it does not protect against value-based SQL injection. An authenticated low-privilege user can inject arbitrary SQL expressions that escape the intended query logic and execute in the database context. The attack requires valid authentication and read access to at least one table. Successful exploitation enables full database exfiltration, credential theft, and potentially data modification or destruction depending on database backend permissions. Patches are available in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.

Affected products

Saltcorn Saltcorn All versions before 1.4.6, 1.5.0-beta.0 through 1.5.5, 1.6.0-alpha.0 through 1.6.0-beta.4

Identifiers

CVE-2026-41478
GHSA-jp74-mfrx-3qvh

Timeline

2026-04-16: disclosed

References

https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.