Is there a patch available for CVE-2026-34400?

Yes, a patch is available for CVE-2026-34400. Update the affected software to the latest version immediately.

PostgreSQL CVE-2026-34400

Q: What is the CVSS score of CVE-2026-34400?

CVE-2026-34400 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17664 MEDIUM

SQL Injection (CWE-89)

2026-03-31 GitHub_M

GHSA-8prr-286p-4w7j

PostgreSQL SQLi

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:31 euvd

EUVD-2026-17664

Analysis Generated

Mar 31, 2026 - 21:31 vuln.today

CVE Published

Mar 31, 2026 - 21:00 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

AnalysisAI

SQL injection in Alerta's Query string search API (q= parameter) allows unauthenticated remote attackers to execute arbitrary SQL commands against the underlying PostgreSQL database. The vulnerability stems from unsafe f-string interpolation of user-supplied search terms directly into SQL WHERE clauses without parameterization. Alerta versions prior to 9.1.0 are affected; the vulnerability has been patched in version 9.1.0 with no public exploit code identified at time of analysis.

Technical ContextAI

Alerta is a monitoring and alerting tool that uses PostgreSQL as its backend database. The vulnerability exists in the Query string search API endpoint, which accepts a 'q=' parameter for user-defined searches. The root cause is CWE-89 (SQL Injection): the application constructs SQL WHERE clauses using Python f-strings that directly interpolate unsanitized user input instead of employing parameterized queries or prepared statements. This classic SQL injection pattern allows attackers to break out of the intended query context and inject arbitrary SQL syntax. The PostgreSQL query parser processes the malformed SQL, enabling full database compromise including data exfiltration, modification, and deletion.

RemediationAI

Upgrade Alerta to version 9.1.0 or later immediately. The vendor-released patch is available as version 9.1.0, which incorporates fixes from PR #2040 and related commits (aeba85a37a09e5769a7a2da56481aa979ff99a00 and fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883) that replace unsafe f-string interpolation with parameterized queries. Users unable to upgrade immediately should restrict network access to the Query string search API endpoint and disable or rate-limit the 'q=' parameter functionality at the application or WAF level. Consult the GitHub Security Advisory at https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j for additional mitigation guidance and to confirm patch availability for your deployment environment.