What is the CVSS score of CVE-2026-34717?

CVE-2026-34717 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openproject are affected by CVE-2026-34717?

OpenProject versions prior to 17.2.3 contain a critical SQL injection vulnerability in the reporting module that allows authenticated users to execute arbitrary database queries, modify data, and…. A patch is available.

How to fix or mitigate CVE-2026-34717?

Within 24 hours: Inventory all OpenProject instances and identify those running versions prior to 17.2.3; assess which have internet exposure or are accessible to untrusted internal users. Within 7 days: Apply vendor-released patch to OpenProject 17.2.3 or later on all affected instances; prioritize systems with sensitive project data or elevated user privileges. Within 30 days: Conduct audit of database access logs (if available) for suspicious queries from OpenProject service accounts during the vulnerability window; review role-based access controls to minimize authenticated user privileges in reporting module.

Openproject CVE-2026-34717

EUVD-2026-18470 HIGH

SQL Injection (CWE-89)

2026-04-02 GitHub_M

SQLi Openproject Opf

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 21:22 NVD

CRITICAL HIGH

CVSS changed

Jul 24, 2026 - 21:22 NVD

9.9 (CRITICAL) 8.1 (HIGH)

Analysis Updated

Apr 21, 2026 - 01:12 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 01:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:47 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

17.2.3

EUVD ID Assigned

Apr 02, 2026 - 18:15 euvd

EUVD-2026-18470

Analysis Generated

Apr 02, 2026 - 18:15 vuln.today

CVE Published

Apr 02, 2026 - 17:59 nvd

CRITICAL 9.9

DescriptionNVD

OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3.

AnalysisAI

SQL injection in OpenProject's reporting module allows authenticated attackers to execute arbitrary database queries via the =n operator. Affects all versions prior to 17.2.3. Attack complexity is low with no user interaction required, enabling authenticated users to escalate privileges, modify data integrity, and potentially compromise availability across scope boundaries. Vendor-released patch confirms fix in version 17.2.3. EPSS score of 0.04% (13th percentile) indicates low probability of mass exploitation, though the CVSS 9.9 critical rating reflects severe potential impact in targeted scenarios. No CISA KEV listing or public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability resides in the reporting module's query operator implementation (modules/reporting/lib/report/operator.rb line 177), specifically within the equals-not (=n) comparison operator. OpenProject uses this operator to construct dynamic SQL WHERE clauses for database queries in its reporting functionality. CWE-89 (SQL Injection) occurs when the operator directly concatenates or interpolates user-supplied filter values into SQL statements without parameterized queries or prepared statements. Ruby on Rails applications typically use ActiveRecord for safe query construction, but custom operators in the reporting module bypass these protections. The affected CPE (cpe:2.3:a:opf:openproject) indicates this is a first-party vulnerability in OpenProject Foundation's core product rather than a dependency issue. The scope change (S:C) in the CVSS vector suggests the vulnerability can affect resources beyond the reporting module's authorization boundary, likely due to shared database connections with elevated privileges.

RemediationAI

Upgrade to OpenProject version 17.2.3 immediately, as confirmed by the official release at https://github.com/opf/openproject/releases/tag/v17.2.3 and security advisory GHSA-5rrm-6qmq-2364. The patch resolves the SQL injection by implementing proper parameterization for the =n operator in the reporting module. For organizations unable to upgrade immediately, implement the following compensating controls with noted trade-offs: (1) Restrict access to the reporting module through permission-based access controls, limiting exposure to only highly trusted administrators (trade-off: reduces reporting functionality for normal users, may impact business workflows); (2) Deploy database activity monitoring to detect abnormal SQL query patterns from the OpenProject application user, particularly complex WHERE clauses or data exfiltration attempts (trade-off: reactive control only, requires security team capacity for alert triage); (3) Apply principle of least privilege to the OpenProject database user account, using read-only permissions where possible and restricting access to sensitive tables (trade-off: may break legitimate application functionality requiring write access, requires extensive testing). These mitigations reduce but do not eliminate risk, as authenticated attackers can still execute queries within granted permissions. Upgrading to 17.2.3 remains the only complete remediation.