CVE-2026-1207: 
Django vulnerability analysis and mitigation

CVE-2026-1207 is an SQL injection vulnerability in Django's RasterField raster lookups (implemented only when using PostGIS) that allows remote attackers to inject arbitrary SQL via the band index parameter. It affects Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) were not formally evaluated but may also be affected. The vulnerability was reported by Tarek Nakkouch and publicly disclosed on February 3, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) per Red Hat, though GitHub Advisory rates it 8.1 (High) under CVSS v4 (Red Hat Advisory, GitHub Advisory).

The root cause is improper neutralization of special elements in an SQL command (CWE-89), specifically in the band index parameter used during raster lookups on RasterField objects in Django's GeoDjango module. This feature is only available when the PostGIS spatial database backend is in use, limiting the attack surface to applications that leverage geospatial raster data. An attacker can craft a malicious band index value that is interpolated directly into a SQL query without adequate sanitization, enabling classic SQL injection. The fix is tracked in Django's source repository at commit 81aa529 (GitHub Advisory, Django Changeset).

Successful exploitation allows a remote attacker to inject and execute arbitrary SQL commands against the underlying PostGIS-enabled database. This can result in unauthorized read access to sensitive data (confidentiality breach), unauthorized modification or deletion of database records (integrity breach), and potentially service disruption depending on the injected payload. The attack vector is network-accessible with low complexity and no required user interaction, making it straightforward to exploit in environments using Django with PostGIS raster functionality (Red Hat Advisory, GitHub Advisory).

As of the time of disclosure, there is no confirmed public proof-of-concept exploit or evidence of active in-the-wild exploitation (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 4.96% (Feedly data) to 6.57% (GitHub Advisory), placing it in the 91st percentile for exploitation probability within 30 days. Nuclei detection templates have been developed and merged into the ProjectDiscovery nuclei-templates repository, and Emerging Threats IDS rulesets have been updated to detect exploitation attempts (GitHub Advisory).

1. Reconnaissance: Identify Django applications using GeoDjango with a PostGIS backend that expose endpoints performing raster lookups on RasterField objects. Tools like Shodan, Censys, or manual code review can help identify targets running affected Django versions (6.0 < 6.0.2, 5.2 < 5.2.11, 4.2 < 4.2.28).
2. Identify vulnerable endpoint: Locate application views or API endpoints that accept a band index parameter and pass it to a RasterField lookup query (e.g., MyModel.objects.filter(raster__contains=GDALRaster(...), raster__band_index=<user_input>)).
3. Craft malicious payload: Construct a band index value containing SQL injection syntax (e.g., 1 OR 1=1-- or 1; DROP TABLE users--) that will be interpolated unsanitized into the generated SQL query.
4. Submit the payload: Send the crafted request to the vulnerable endpoint via HTTP GET or POST, embedding the malicious band index value in the appropriate parameter.
5. Extract or manipulate data: Depending on the injection type (error-based, union-based, or blind), retrieve sensitive database contents, modify records, or escalate further within the database environment (GitHub Advisory, Django Security Releases).

• Network: Unusual HTTP requests to GeoDjango raster-related endpoints containing SQL metacharacters (e.g., ', --, OR 1=1, UNION SELECT) in band index parameters; unexpected outbound database connections or data exfiltration traffic from the application server.
• Logs: Django application logs or web server access logs showing requests with anomalous band index values (non-integer or containing SQL syntax); database query logs recording unexpected SQL statements involving raster lookups with injected clauses.
• Database: Unexpected query patterns in PostGIS/PostgreSQL query logs, such as UNION SELECT, OR 1=1, or stacked queries originating from the Django application's database user; unauthorized schema changes or data access patterns.
• Process: Unusual database activity from the Django application's DB credentials, including access to tables unrelated to normal application function.

Django has released patched versions addressing this vulnerability: 6.0.2, 5.2.11, and 4.2.28. All users running affected versions should upgrade immediately to the appropriate patched release (Django Security Releases). For applications running unsupported Django series (5.0.x, 4.1.x, 3.2.x), upgrading to a supported and patched version is strongly recommended. As a defense-in-depth measure where immediate patching is not possible, restrict network access to endpoints that use PostGIS raster functionality and implement input validation to reject non-integer band index values. Red Hat has issued errata (RHSA-2026:3958, RHSA-2026:3959, RHSA-2026:5970, RHSA-2026:5971, RHSA-2026:2694, RHSA-2026:5971) for affected products including Ansible Automation Platform and Red Hat Satellite (Red Hat Bugzilla).

The Django security team published a blog post on February 4, 2026 discussing recent trends observed by the security team in the context of this and related releases (Django Blog). Security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and Cyble covered the vulnerability, with several describing it as part of a broader set of critical Django security fixes. CrowdSec tracked the vulnerability and published a vulnerability tracking report. The Emerging Threats community updated its IDS ruleset (v11126 and v11176) to include detection rules for exploitation attempts. Multiple Linux distribution maintainers (Ubuntu, Debian, Fedora, SUSE, Mageia) issued security advisories and package updates in response (Django Security Releases, CrowdSec Report).