EUVD-2026-33552
GHSA-4vhj-5qc2-97wr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed OTRS instance
-
DeliveryConfirm MySQL NO_BACKSLASH_ESCAPES mode
-
ExploitSend crafted single-quote payload to pre-auth endpoint
-
InstallBreak out of escaped string literal
-
C2Inject SQL altering auth query
-
ExecuteObtain valid administrator session
-
ImpactExfiltrate tickets and credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires (1) a network-reachable OTRS or ((OTRS)) Community Edition instance running an affected version (7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.4.X, or CE 6.0.x), and (2) the backing MySQL or MariaDB server configured with the NO_BACKSLASH_ESCAPES SQL mode in the session used by OTRS - this is not the default sql_mode for either engine and is the binding gate on exploitability. No authentication, no user interaction, and no special platform are required (CVSS PR:N/UI:N); the limiting factor is entirely the database configuration. Deployments using PostgreSQL or other non-MySQL backends, or MySQL/MariaDB without NO_BACKSLASH_ESCAPES, are not exploitable via this issue per the vendor description. |
| Impact | Signals are mixed and require careful reading. The CVSS vector AV:N/AC:L/PR:N/UI:N is maximally permissive - fully remote, unauthenticated, no user interaction - and impact is C:H/I:H (full read of ticket data and write/manipulation including auth bypass) with A:N (no availability impact, consistent with an injection that hijacks queries rather than crashing the server). However, the description establishes a hard precondition: the MySQL/MariaDB server must run with NO_BACKSLASH_ESCAPES, which is not the default SQL mode for either engine, materially narrowing the exploitable population below what a 9.1 score suggests. No CISA KEV listing and no public POC were provided in the intelligence set, and no EPSS score was supplied, so the immediate mass-exploitation risk appears lower than the score implies - though OTRS is an attractive target (contains support tickets, internal credentials, customer PII), so for organizations matching the SQL-mode precondition this is a top-priority patch. Note also that the description characterizes the database configuration trigger but does not enumerate which OTRS deployments ship or recommend NO_BACKSLASH_ESCAPES; verify your specific MySQL/MariaDB sql_mode setting before deprioritizing. |
| Exploit ScenarioDerived | An attacker reaches an internet-exposed OTRS login or other pre-auth endpoint, submits a crafted parameter containing a single quote that the application's backslash-based escaping fails to neutralize because the database is running in NO_BACKSLASH_ESCAPES mode, and injects SQL that returns a valid session for an administrative account - yielding full read of tickets, customer data, and configuration. No public exploit identified at time of analysis, but the bug class (string-quote-breakout via SQL mode mismatch) is well understood and trivially weaponizable once the precondition is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
Unauthenticated SQL injection in OTRS and the legacy ((OTRS)) Community Edition database layer enables authentication bypass when the backing MySQL/MariaDB instance runs with the NO_BACKSLASH_ESCAPES SQL mode. The flaw carries a CVSS of 9.1 with network-reachable, no-privileges-required exploitation against confidentiality and integrity, but no public exploit identified at time of analysis and the issue is gated by a specific non-default database configuration.
RemediationAI
Vendor-released patch: upgrade OTRS to the 2026.4.X line per OTRS Security Advisory 2026-02 (https://otrs.com/release-notes/otrs-security-advisory-2026-02/); the 7.0.X, 8.0.X, 2023.X, 2024.X, and 2025.X branches and ((OTRS)) Community Edition 6.0.x are listed as affected without a clearly enumerated fix release in the available data, so customers on those lines should contact OTRS support or migrate to the patched 2026.4.X line. As an immediate compensating control, inspect the backing MySQL/MariaDB sql_mode (SELECT @@sql_mode) and remove NO_BACKSLASH_ESCAPES from both global and session modes - this neutralizes the precondition for this specific bug but may break applications that intentionally rely on standard-SQL string semantics, so test before deploying. Additional defense-in-depth options include restricting network access to the OTRS web frontend to trusted IP ranges or placing it behind a WAF tuned for SQLi patterns on login endpoints, accepting that WAF coverage of NO_BACKSLASH_ESCAPES-mode injections may be incomplete.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OTRS is a widely deployed open-source ticketing and helpdesk platform written in Perl; the ((OTRS)) Community Edition is its legacy community-maintained fork (the 6.0.x line). The root cause is CWE-20 Improper Input Validation in the database abstraction layer: OTRS's escaping logic assumes the standard MySQL/MariaDB behavior of treating backslash as an escape character within string literals. When the database session is started with the NO_BACKSLASH_ESCAPES SQL mode, backslashes are treated literally, so the application's quote-escaping no longer neutralizes attacker-supplied single quotes, allowing breakout of the string context and arbitrary SQL clause injection. Because the injection sits in pre-authentication code paths, an attacker can manipulate the login query to bypass authentication entirely. CPE coverage confirms cpe:2.3:a:otrs_ag:otrs and cpe:2.3:a:otrs_ag:((otrs))_community_edition as the affected products.
Know when Otrs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (OTRS) · only source for this CVE.
CVSS VectorVendor: OTRS
DescriptionCVE.org
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.
This issue affects OTRS:
- 7.0.X
- 8.0.X
- 2023.X
- 2024.X
- 2025.X
- 2026.X before 2026.4.X
- (OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
Executive ViewAI
OTRS and OTRS Community Edition contain a critical SQL injection vulnerability that allows unauthenticated attackers to bypass authentication entirely, exposing all customer support tickets and sensitive data. Organizations running OTRS with the affected MySQL/MariaDB configuration (NO_BACKSLASH_ESCAPES SQL mode) face complete compromise of their support infrastructure with no currently available vendor patch. This requires immediate assessment and interim protective measures.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable NO_BACKSLASH_ESCAPES SQL mode in MySQL/MariaDB if operationally feasible; (2) Deploy Web Application Firewall rules to block SQL injection attempts; (3) Implement network segmentation to limit OTRS database connectivity; (4) Enforce database-level access controls and connection restrictions; (5) Enable comprehensive logging and alerting on failed authentication and SQL errors; (6) Monitor for suspicious database queries and authentication patterns; (7) Consider temporary restriction of OTRS external access until patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in OTRS Authorization, Injection, and XSS Flaws
View all 7In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.2
In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenti
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm,
Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS]
Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via Tic
Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Op
Authentication bypass in ((OTRS)) Community Edition 6.x and earlier lets an unauthenticated remote attacker impersonate
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x befor
OTRS fails to immediately invalidate previously issued JWT authentication tokens when an agent or customer user account
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS base
In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with
Exploit-DB