CVE-2026-82039

HighCVSS 8.8/10Last modified Oct 6, 2026

Description

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-82045.3Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data CVE-2026-820405.0UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows au CVE-2026-820419.9UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped t CVE-2026-820429.8UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access CVE-2026-820435.3UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email ad CVE-2026-820447.7UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request CVE-2026-820456.5UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploit CVE-2026-820498.4In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link CVE-2026-82055.3Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on t CVE-2026-820526.5The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod)CVE-2026-820538.1A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities CVE-2026-820546.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command include