Skip to main content

Netatalk CVE-2026-44047

| EUVDEUVD-2026-31226 HIGH
SQL Injection (CWE-89)
2026-05-21 securin GHSA-p2g3-q382-2rhw
SQLi Netatalk
8.8
CVSS 3.1 · Vendor: securin
View

Vulnerability Assessment

Weakness
CWE
CWE-89
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Persistence

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 21, 2026

SQL injection in Netatalk 3.1.0 through 4.4.2 allows authenticated remote attackers to compromise the MySQL-backed CNID (Catalog Node ID) database used to track AppleTalk/AFP file metadata. The high CVSS 8.8 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) reflects network-reachable exploitation with low privileges and high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis.

Affected VersionsENISA

Netatalk 3.1.0 ≤4.4.2

Affected Packages

euvd netatalk no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Netatalk gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (securin) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH

Primary rating from Vendor (securin).

CVSS VectorVendor: securin

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In Netatalk 3.1.0 through 4.4.2, sql injection in mysql cnid backend. Fixed in 4.4.3.

Executive ViewAI

Why It Matters

A high-severity SQL injection vulnerability (CVE-2026-44047) in Netatalk 3.1.0 through 4.4.2 permits authenticated remote attackers to directly manipulate the MySQL-backed CNID database that maintains file metadata for AppleTalk/AFP file services. Organizations operating affected Netatalk versions face risk of unauthorized modification, deletion, or exfiltration of critical file metadata, potentially compromising file integrity, audit capabilities, and continuity of file-sharing operations. The vulnerability's requirement for authenticated access narrows exposure scope but does not eliminate risk in environments with broader user access to AFP services.

Recommended Action

Within 24 hours: Inventory all systems running Netatalk versions 3.1.0 through 4.4.2 and document CNID database backend configurations. Within 7 days: Enforce database-level access restrictions limiting CNID connections to Netatalk service accounts only, enable and monitor MySQL query logging for Netatalk service activity, and review active AFP share configurations to disable unnecessary shares. Within 30 days: Monitor Netatalk project advisories for patch release, establish upgrade testing environment for future patched versions, and implement network segmentation between Netatalk services and CNID databases.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict CNID database network access to Netatalk service accounts only-block all external and user-level connections; (2) Configure dedicated, low-privilege MySQL service accounts per Netatalk instance; (3) Enable MySQL query logging and implement real-time monitoring for SQL injection attack patterns; (4) Deploy database activity monitoring (DAM) with alerting on suspicious data modifications; (5) Tighten file-level permissions and network ACLs on AFP shares to minimize authenticated attacker reach; (6) Maintain frequent, tested database backups with point-in-time recovery capability; (7) Prepare and pre-test upgrade plan for immediate deployment upon patch release.

Threat Intelligence Overview

EPSS Score
0.1%
Top 76% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

SQL Injection HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

More in Netatalk

View all
CVE-2018-1160 CRITICAL POC
9.8 Dec 20

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. Rated critical severity (CVSS 9.8), th
CVE-2022-45188 HIGH POC
7.8 Nov 12

Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl fi
CVE-2026-44050 CRITICAL
9.9 May 21

Heap buffer overflow in the Netatalk cnid_metad daemon's comm_rcv() function allows remote attackers with low-level priv
CVE-2023-42464 CRITICAL
9.8 Sep 20

A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. Rated c
CVE-2022-22995 CRITICAL
9.8 Mar 25

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of file
CVE-2026-44048 HIGH
8.8 May 21

Stack-based buffer overflow in Netatalk versions 2.0.4 through 4.4.2 allows authenticated remote attackers to corrupt me
CVE-2021-31439 HIGH
8.8 May 21

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology Dis
CVE-2026-44051 HIGH
8.1 May 21

Arbitrary file read in Netatalk 3.0.2 through 4.4.2 allows authenticated remote attackers to create attacker-controlled

CVE-2026-44068 HIGH
7.6 May 21

Path traversal via extended attribute (ea) handling in Netatalk 2.1.0 through 4.4.2 allows authenticated remote attacker
CVE-2026-44055 HIGH
7.5 May 21

Shell injection in Netatalk 3.1.4 through 4.4.2 allows authenticated remote attackers to execute arbitrary OS commands t
CVE-2026-44062 HIGH
7.5 May 21

Out-of-bounds write in Netatalk versions 2.0.4 through 4.4.2 stems from a missing o_len bounds check in the pull_charset
CVE-2026-44049 HIGH
7.5 May 21

Out-of-bounds write in Netatalk versions 2.0.4 through 4.4.2 affects the convert_charset() routine during null terminati

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2013-0333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Server 12 SP5 Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP5 Fixed
SUSE Linux Enterprise Desktop 12 Fixed

References

Advisories & patches
ADVISORY https://netatalk.io/security/CVE-2026-44047 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-44047 ADVISORY https://vuldb.com/vuln/364547

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy