CVE-2026-40906
Published: 21 April 2026
Summary
CVE-2026-40906 is a critical-severity SQL Injection (CWE-89) vulnerability in Electric Sync-Service. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-40906 is an error-based SQL injection vulnerability (CWE-89) in the order_by parameter of the ElectricSQL /v1/shape API within Electric, a Postgres sync engine. It affects versions from 1.1.12 up to but not including 1.5.0. The issue carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for network-based exploitation with low complexity.
Any authenticated user (PR:L) can exploit this vulnerability remotely without user interaction. By submitting crafted ORDER BY expressions, attackers gain the ability to read, write, and destroy the full contents of the underlying PostgreSQL database, resulting in high impacts to confidentiality, integrity, and availability within an expanded scope.
The vulnerability is addressed in Electric version 1.5.0. Additional details on the fix and remediation are available in the GitHub security advisory GHSA-h5rg-pxx7-r2hj and pull request #4081.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24475
Vulnerability details
Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying…
more
PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing /v1/shape API endpoint directly maps to exploitation of public-facing application for remote DB compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection attacks like this CVE by validating and sanitizing the order_by parameter before incorporation into database queries.
Mitigates the vulnerability by requiring timely installation of the specific fix in Electric version 1.5.0.
Addresses the error-based nature of the SQL injection by suppressing detailed error messages that could leak database information during exploitation.