EUVD-2026-50407
GHSA-9cc8-j46r-gq7j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SOAP API, low complexity, requires a low-privilege authenticated account (PR:L); full DB read plus unauthorized commands justify high C/I/A with no scope change.
Primary rating from Vendor (BlackDuck).
CVSS VectorVendor: BlackDuck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands.
AnalysisAI
SQL injection in the Coverity Connect SOAP API (versions 2024.6.0 through 2026.3.0 inclusive) lets an authenticated attacker submit a crafted SOAP payload to read the entire backing database and issue other unauthorized SQL commands. Rated CVSS 4.0 8.7 (High) and reported through a Black Duck product security advisory, it requires only low-privilege authentication and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a valid Coverity Connect account of at least low privilege (CVSS PR:L - authenticated), (2) network reachability to the Coverity Connect SOAP API endpoint, and (3) a target running an affected version between 2024.6.0 and 2026.3.0 inclusive. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) describes a network-reachable, low-complexity flaw needing only low-privilege credentials and no interaction, yielding high confidentiality/integrity/availability impact on the vulnerable system with no scope change - consistent with an authenticated SQLi that exposes the full database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privilege Coverity Connect credentials - for example a departing developer, a phished user, or a leaked service account - sends a specially crafted SOAP API request whose parameter breaks out of the intended SQL query. Using the injection they enumerate and dump database contents (project data, user records, configuration) and issue further unauthorized commands. … |
| Remediation | Upgrade Coverity Connect to a fixed release as directed by the Black Duck Product Security Advisory (https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-8339-SQL-Injection-Vulnerability-in-Coverity-Connect-SOAP-API); no exact fixed version number was included in the provided data, so consult the advisory for the specific patched build above 2026.3.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Coverity Connect SOAP API access logs to identify any suspicious activity and verify that database backups are isolated and recoverable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today