# CVE-2026-57190: Asterisk SQL injection in CEL event logging

Source: https://junglewise.ai/threats/cve-2026-57190-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57190 · Severity: info · Published 2026-10-27

Asterisk is an open-source telephony server that handles call routing and event logging. A flaw in the Channel Event Log (CEL) backends for PostgreSQL and MSSQL databases allows attackers to execute arbitrary SQL commands by injecting malicious data through the CELGenUserEvent dialplan application, potentially leading to unauthorized data access or modification in the call logging database.

Technologies: [Asterisk Project Asterisk](https://junglewise.ai/threats/technologies/asterisk-project-asterisk), [Asterisk Project Certified Asterisk](https://junglewise.ai/threats/technologies/asterisk-project-certified-asterisk). Vendors: [Asterisk Project](https://junglewise.ai/threats/vendors/asterisk-project).

## Quick answers

**Is CVE-2026-57190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57190 being exploited in the wild.

**How severe is CVE-2026-57190?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Asterisk Project Asterisk before 20.20.1, 21.12.3, 22.10.1, 23.4.1; Asterisk Project Certified Asterisk before 20.7-cert11, 22.8-cert3.

**Is there a fix for CVE-2026-57190?** Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57190 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57190?** Check whether you run Asterisk Project Asterisk or Asterisk Project Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3

## Technical details

SQL injection vulnerability in cel_pgsql.c and cel_tds.c where the eventtype field is inserted directly into SQL queries without proper escaping or sanitization. While other string fields in these modules correctly use PQescapeStringConn() (PostgreSQL) and anti_injection() (MSSQL), the user_defined_name field bypasses these protections. An attacker with the ability to call CELGenUserEvent in the dialplan can inject arbitrary SQL through this field to read or modify database contents.

## Affected products

- Asterisk Project Asterisk before 20.20.1, 21.12.3, 22.10.1, 23.4.1
- Asterisk Project Certified Asterisk before 20.7-cert11, 22.8-cert3

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/asterisk/asterisk/commit/046a8b0b50623d80926c1adc2eca1c9c17e258ed](https://github.com/asterisk/asterisk/commit/046a8b0b50623d80926c1adc2eca1c9c17e258ed)
- [https://github.com/asterisk/asterisk/commit/0a86e45e8cde7630276f8363de45f71d1635d2f4](https://github.com/asterisk/asterisk/commit/0a86e45e8cde7630276f8363de45f71d1635d2f4)

## Related threats

- [Asterisk SMS buffer overflow in app_sms](https://junglewise.ai/threats/cve-2026-57199-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk heap buffer overflow in Codec2 decoder](https://junglewise.ai/threats/cve-2026-57192-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk buffer overflow in MWI NOTIFY parser](https://junglewise.ai/threats/cve-2026-57191-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk buffer over-read in PJSIP MWI parser](https://junglewise.ai/threats/cve-2026-57185-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk heap-use-after-free in PJSIP TCP/SDP handling](https://junglewise.ai/threats/cve-2026-57187-asterisk-is-an-open-source-private-branch-exchange-and-telephony)