CVE-2026-2613

Summary

The Admin REST API performs blind SQL injection by embedding unsanitized user input into SQL queries, allowing an authenticated administrator to infer database contents and disrupt service availability.

Exploitability

Exploitation requires valid administrator credentials and knowledge of vulnerable API endpoints; no public exploit exists, but the attack is technically straightforward for a privileged insider.

Blast radius

Successful exploitation could leak sensitive database contents via time-based or error-based inference and cause denial-of-service through resource exhaustion or targeted query manipulation.

Detection

Look for unusually long or time-delayed HTTP responses from the Admin REST API, especially when paired with SQL-specific patterns (e.g., 'SLEEP(', 'WAITFOR DELAY', or repeated sequential requests) in access logs; also monitor for anomalous query execution times in database logs correlated with admin API calls.

Prioritized remediation

Upgrade to the fixed version specified by the vendor; if no version is named, disable the affected Admin REST API endpoint immediately and restrict access to trusted networks or roles until remediated.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.