CVE-2026-34400

Medium

Published: 31 March 2026

Published

31 March 2026

Modified

10 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0050 39.2th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-34400 is a medium-severity SQL Injection (CWE-89) vulnerability in Alerta Project Alerta. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-34400 is a SQL injection vulnerability in Alerta, an open-source monitoring tool. Prior to version 9.1.0, the Query string search API endpoint (q= parameter) is susceptible to injection attacks due to the Postgres query parser constructing WHERE clauses by directly interpolating user-supplied search terms into SQL strings using f-strings. This flaw, classified under CWE-89, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with potential for high impacts across confidentiality, integrity, and availability.

The vulnerability can be exploited remotely by unauthenticated attackers with network access to the Alerta instance. By crafting malicious input for the q= parameter in API requests, attackers can manipulate SQL queries executed against the Postgres backend, enabling arbitrary SQL execution such as data exfiltration, modification, or deletion.

Mitigation is available via upgrading to Alerta version 9.1.0, where the issue was patched. Relevant GitHub references include the primary fix commit (aeba85a37a09e5769a7a2da56481aa979ff99a00), an additional commit (fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883), pull requests #2040 and #712, and the release tag for v9.1.0.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-17664

Vulnerability details

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings.…

This issue has been patched in version 9.1.0.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing API endpoint directly maps to T1190 for remote unauthenticated exploitation; arbitrary SQL execution against Postgres backend enables data collection from databases per T1213.006.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0