What is the CVSS score of CVE-2026-57230?

CVE-2026-57230 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-57230?

Yes, a patch is available for CVE-2026-57230. Update the affected software to the latest version immediately.

OpenReplay CVE-2026-57230

EUVD-2026-43035 MEDIUM

SQL Injection (CWE-89)

2026-07-10 GitHub_M

SQLi Openreplay

5.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network API injection requiring only authenticated member access; AC:L because injection conditions are straightforward; UI:N because no victim interaction is needed; C:H for arbitrary table read; A:L for persistent search disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 22:07 vuln.today

Patch available

Jul 10, 2026 - 22:02 EUVD

DescriptionCVE.org

OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.

AnalysisAI

SQL injection in OpenReplay's enterprise session search and analytics API allows an authenticated member to exfiltrate arbitrary ClickHouse table data and disrupt session search for all project viewers. Affected are enterprise editions with multi-tenancy enabled, running versions prior to 1.27.0, where user-controlled input is inserted unsanitized into ClickHouse query strings at two positions. No public exploit has been identified at time of analysis, and the fix was released in version 1.27.0.

Technical ContextAI

OpenReplay is a self-hosted session replay platform (CPE: cpe:2.3:a:openreplay:openreplay:*:*:*:*:*:*:*:*). The vulnerable component is the session search and analytics API, which constructs ClickHouse queries - ClickHouse being a columnar OLAP database commonly used for analytics workloads. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically the failure to parameterize or escape user-supplied values before interpolating them into raw ClickHouse query strings. This is exploitable at two distinct injection points, enabling both blind boolean-based and time-based SQL inference attacks, which are standard techniques for extracting data without direct query output. The vulnerability is scoped to enterprise editions with multi-tenancy enabled, meaning shared-tenant environments where a member of one tenant can potentially reach data belonging to other tenants or internal system tables.

RemediationAI

Upgrade to OpenReplay version 1.27.0, which contains the fix per the official release at https://github.com/openreplay/openreplay/releases/tag/v1.27.0. The underlying fix is implemented in pull request #4715 (https://github.com/openreplay/openreplay/pull/4715) and commit ae8de6893250dd41175c6b2d312545c515fa5a16, which introduces proper escaping or parameterization of user input in the ClickHouse query builder. If an immediate upgrade is not possible, compensating controls include restricting member-level access to the session search and analytics API at the network or application proxy layer, disabling multi-tenancy if the deployment does not require it (this removes the vulnerable code path per the description), and auditing ClickHouse query logs for anomalous time delays or unusual boolean patterns indicative of blind injection attempts. Note that disabling multi-tenancy may affect tenant isolation features and require organizational coordination.