Executive brief
WAPT Server is an enterprise software management and deployment platform used to manage packages and updates across corporate networks. A SQL injection vulnerability in its API allows authenticated users with read-only access to bypass database access restrictions, access unauthorized data from other tables, and potentially execute arbitrary database operations. This could lead to exposure of sensitive configuration and host information stored in the WAPT database.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in the `columns` parameter of the GET `/api/v3/hosts` API endpoint in WAPT Server. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions that bypass SQL query parameterization, allowing them to craft malicious queries. The attack requires network access to the WAPT Server API and valid read-only credentials. An attacker can inject additional PostgreSQL statements to bypass host scope restrictions and read data from other database rows or tables. The vulnerability is patched in version 2.6.1.17852 and later (first disclosed in 2.6.1.17861).
Affected products
- Tranquil IT WAPT Server 2.6.1.17834 and earlier; 2.6.x versions
Timeline
- 2026-08-31: disclosed
- 2026-08-27: patched: Fix released in version 2.6.1.17861