What is the CVSS score of CVE-2026-71276?

CVE-2026-71276 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Magistrala are affected by CVE-2026-71276?

Magistrala's message-readers API contains a security flaw (CVE-2026-71276) that enables any authenticated user to exfiltrate database contents, creating insider threat risk across the organization.

How to fix or mitigate CVE-2026-71276?

Within 24 hours, conduct a comprehensive inventory of all Magistrala deployments and their connected PostgreSQL/TimescaleDB instances, identify authenticated users with API access, enable database query logging, and deploy monitoring for suspicious access patterns. Within 7 days, implement firewall rules restricting message-readers API access to essential clients only, review and minimize database role privileges to limit exploitable query scope, and evaluate temporary disabling of the API endpoint if operationally feasible. Within 30 days, establish direct vendor contact to confirm Magistrala patch release timelines, evaluate alternative message-processing platforms with active security maintenance, and document a migration or upgrade plan contingent on patch availability.

Magistrala CVE-2026-71276

EUVD-2026-53361 HIGH

SQL Injection (CWE-89)

2026-08-05 TuranSec

GHSA-pwc8-43hr-jg4j

PostgreSQL SQLi Magistrala

7.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-accessible API requires only a low-privilege authenticated session (PR:L); table-name injection position constrains write-path impact to I:L; no availability impact in a read-path query context.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:41 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 7.1

DescriptionCVE.org

Magistrala (formerly Mainflux)'s message-readers API reads a format value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf() in both the PostgreSQL reader (readers/postgres/messages.go: fmt.Sprintf("SELECT * FROM %s WHERE %s ...", format, cond)) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.

AnalysisAI

SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated format HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's fmt.Sprintf() in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Magistrala (formerly Mainflux) is an open-source IoT messaging and device-management platform by absmach. The vulnerability is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw originating in the HTTP transport layer at readers/api/http/transport.go, which reads the format query string parameter and passes it unsanitized downstream. Both the PostgreSQL reader (readers/postgres/messages.go) and TimescaleDB reader (readers/timescale/messages.go) construct raw SQL using the pattern fmt.Sprintf("SELECT * FROM %s WHERE %s ...", format, cond). Because the injection occurs at the SQL identifier (table name) position rather than a value position, standard parameterized query drivers cannot protect against it - PostgreSQL does not support bind parameters for identifiers. This means the only correct fix is allowlist validation of the format value before query construction. Depending on the Go PostgreSQL driver configuration, stacked queries or subquery-based exfiltration techniques may be feasible.

RemediationAI

No vendor-released patch has been identified at time of analysis - available references point only to the upstream repository and vulnerable source files, with no fixed release or security advisory noted. Operators should immediately restrict access to the message-readers API endpoint to the minimum set of authenticated principals required, enforced at the API gateway or network-policy layer. As a code-level compensating control, developers should implement strict allowlist validation on the format parameter before it reaches the SQL construction path - reject any value not matching the exact set of expected table identifiers using a map or switch statement; do not use regex alone, as bypass risk exists. Since PostgreSQL does not support parameterized identifiers, driver-level escaping is insufficient and the allowlist is the only sound fix. Monitor the upstream repository at https://github.com/absmach/magistrala for a patched release. Enabling PostgreSQL statement-level logging can help detect exploitation attempts in the interim.