EUVD-2026-81059
GHSA-mwg5-jprr-5586
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SQL interface, low complexity, PR:L for the required read-only account; C:H from credential-table disclosure, with I:H/A:H reflecting the resulting administrator takeover via stolen hashes.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
AnalysisAI
Multi-statement SQL authorization bypass in Manticore Search 27.0.0 through 28.4.3 lets an authenticated read-only user escalate to full administrative control: the server validates permissions only for the first statement in a batch, so appending additional SELECT statements exposes system credential tables and their password hashes, which can be replayed to authenticate as an administrator without cracking any plaintext. No user interaction is required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the only prerequisite is an existing low-privileged account with SQL access over the MySQL-protocol interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid but low-privileged (read-only) authenticated account on a Manticore Search instance running an affected version (27.0.0 through 28.4.3) that accepts multi-statement SQL requests over the MySQL protocol interface; the attacker crafts a request appending extra SELECT statements after the first, whose permissions are never re-validated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable priority rather than a high-CVSS-but-low-real-risk paper finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Manticore Search 28.4.4 or later: vendor-released patch version 28.4.4 contains the fix in src/auth/auth_proto_mysql.cpp (lines 408-418 on the release-28.4.4 branch, github.com/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418), and the upstream issue is github.com/manticoresoftware/manticoresearch/issues/4706. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Manticore Search deployment and confirm which instances run versions 27.0.0 through 28.4.3; on any affected instance, restrict the MySQL-protocol interface to trusted hosts and review all SQL-capable accounts to confirm none hold privileges beyond strict business need. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today