Magistrala CVE-2026-71276

Exploitation requires a valid authenticated Magistrala account with permission to query channel messages via the message-readers HTTP API - PR:L per the CVSS vector confirms authentication is required. No elevated privileges beyond a standard user session are needed, and no special platform configuration or non-default feature flag must be enabled; the vulnerable fmt.Sprintf() code path executes for any authenticated channel-message query that includes a format parameter. Exploitation is limited by: (1) the mandatory authenticated session, reducing exposure compared to unauthenticated flaws; (2) injection at the SQL identifier (table name) position rather than a WHERE-clause value, which constrains available injection techniques and may require stacked-query support from the underlying Go PostgreSQL driver; (3) network-layer restrictions - environments where the message-readers API is not externally reachable reduce exposure to internal or service-account threats only.

The CVSS 7.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) accurately reflects a network-accessible, low-complexity flaw requiring only a low-privilege authenticated session. The PR:L requirement is the primary real-world limiting factor: unauthenticated exploitation is not possible per the CVSS vector, reducing mass-exploitation risk compared to PR:N flaws. However, in IoT deployments where many device accounts or service users hold API credentials, this is not a strong deterrent. No EPSS probability data was provided, preventing quantitative exploitation likelihood assessment. KEV status is not confirmed and no POC has been publicly disclosed, so exploitation remains theoretical at time of analysis. The I:L rating (rather than I:H) suggests the injection mechanism may have constrained write-path impact - possibly due to the table-name injection position limiting DML mutation compared to WHERE-clause injection - though the exact driver behavior governs this. The wildcard CPE indicates no known safe version exists, which elevates urgency despite the absence of a confirmed public exploit. This is a genuine priority for Magistrala operators, not a high-CVSS-but-low-real-risk case, given that data exfiltration via C:H is well-supported by the described code pattern.

An authenticated Magistrala user with channel-read permissions sends a crafted GET request to the message-readers API endpoint, supplying a malicious value for the format query parameter - for example, injecting a subquery or UNION-based payload in the table-name position. The Go fmt.Sprintf() call passes the unsanitized value directly to the PostgreSQL or TimescaleDB query executor, returning rows from unintended database tables or triggering further SQL operations. No public exploit code has been identified at time of analysis, but the injection point is straightforward to identify via the publicly referenced source file.