Coturn EUVD-2026-42969

Requires an authenticated administrator session on Coturn's optional HTTPS admin panel (PR:H), which must be enabled and network-reachable by the attacker - it is not part of a default STUN/TURN relay configuration. The concrete injectable inputs are the du, ds, and dip HTTP query parameters of the delete-user, delete-secret, and delete-IP operations, which bypass the is_secure_string filter. Full data-level impact applies to any SQL backend; the escalation to OS-level command execution specifically requires a PostgreSQL backend where the Coturn database role has sufficient privilege to invoke COPY TO PROGRAM. Limiting factors: valid admin authentication, the admin panel being deployed/exposed, and (for host compromise) a PostgreSQL backend with a superuser-equivalent role - all of which reduce realistic exposure below the raw network-vector score.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, no user interaction, but requiring high privileges (an authenticated admin, PR:H), with total confidentiality, integrity, and availability impact on the database. This PR:H requirement is the dominant risk-limiting signal: the attacker must already hold admin credentials and network access to the admin panel, which is not enabled or internet-exposed by default. No EPSS score was supplied in the input, and the CVE is not present in CISA KEV, so there is no evidence of active exploitation; no POC was provided either, so this is best characterized as 'no public exploit identified at time of analysis.' The realistic priority is moderate: it is a post-authentication privilege-to-impact escalation rather than a pre-auth mass-exploitable flaw. However, the potential jump from admin-of-Coturn to OS command execution via PostgreSQL COPY TO PROGRAM meaningfully raises the ceiling, effectively turning admin-panel access into host compromise - organizations exposing the admin panel or with weak admin credential hygiene should treat it as higher priority. Note the scope is rated S:U in the supplied vector, but COPY TO PROGRAM code execution on a separate DB host is arguably a scope change (S:C); verify against your deployment topology.

An attacker who has obtained or been granted Coturn admin panel credentials (or an insider abusing legitimate access) sends a crafted HTTPS request to the delete-user endpoint with a malicious du parameter containing SQL metacharacters. Because the input is interpolated straight into the query, the attacker reads or modifies the entire credential database and, against a PostgreSQL backend running as a privileged role, chains COPY TO PROGRAM to execute shell commands on the database host. No public POC was provided, and the low attack complexity (AC:L) means exploitation is reliable once admin access and network reachability are in hand.