Which versions of Pandora FMS are affected by CVE-2026-34187?

Pandora FMS versions 777-800 contain a SQL injection vulnerability that allows authenticated users with low privileges to access or alter database contents through the graph container parameter.

How to fix or mitigate CVE-2026-34187?

Within 24 hours: Identify and inventory all Pandora FMS deployments and document current version numbers (check /etc/pandora/pandora_server.conf or admin console version reporting). Within 7 days: Contact PandoraFMS vendor support to confirm available patched versions beyond 800 and obtain estimated release timeline for the affected version line; implement network-level access controls restricting database connectivity to trusted administrators only. Within 30 days: Upgrade all instances from versions 777-800 to the latest patched release once available; if upgrade is not possible, implement application-level input validation and prepared statements in custom graph container code as interim mitigation.

Pandora FMS CVE-2026-34187

Q: What is the CVSS score of CVE-2026-34187?

CVE-2026-34187 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-29512 HIGH

SQL Injection (CWE-89)

2026-05-12 PandoraFMS

GHSA-wxjr-vrjv-wjm5

SQLi Pandora Fms

7.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 16:33 vuln.today

CVSS changed

May 12, 2026 - 16:22 NVD

7.6 (HIGH)

CVE Published

May 12, 2026 - 15:13 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

SQL injection in Pandora FMS versions 777-800 allows authenticated attackers with low privileges to exfiltrate or manipulate database contents via the graph container parameter. Attack complexity is high with present attack techniques, requiring specific timing conditions. No active exploitation confirmed per CISA KEV, and EPSS data not provided. Vendor advisory available from PandoraFMS confirms the vulnerability affecting a narrow version range spanning approximately builds 777 through 800.

Technical ContextAI

Pandora FMS is an open-source infrastructure monitoring platform. This vulnerability stems from CWE-89 (Improper Neutralization of Special Elements in SQL Command), indicating the graph container parameter fails to sanitize user input before incorporating it into SQL queries. The CVSS 4.0 vector specifies network-based attack vector (AV:N) but requires authenticated low-privilege access (PR:L) and presents high attack complexity with present attack techniques (AC:H/AT:P). The affected CPE cpe:2.3:a:pandora_fms:pandora_fms identifies the core monitoring application. The graph container parameter likely relates to Pandora FMS's graphing and reporting functionality, where visualizations can be organized into containers. Vulnerable SQL query construction in this component enables injection attacks when authenticated users interact with graph management features.

RemediationAI

Upgrade Pandora FMS to version 801 or later, which remediates the SQL injection vulnerability in the graph container parameter handling. The vendor security advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ should contain specific upgrade instructions and release notes. If immediate patching is not feasible, implement compensating controls: restrict access to graph management functionality using role-based access controls to trusted administrators only (reducing attack surface by limiting who can interact with the vulnerable parameter); deploy web application firewall rules to detect and block SQL injection attempts in graph container parameters, though this provides defense-in-depth rather than complete protection and may generate false positives requiring tuning; monitor database query logs for suspicious patterns such as UNION statements, comment sequences, or time-based blind injection signatures in queries originating from graph-related application code, understanding this is detective not preventive and requires dedicated log analysis resources. Disabling graph container functionality entirely eliminates the attack vector but significantly reduces Pandora FMS operational utility for visualization workflows.