CVE-2026-1287: 
Django vulnerability analysis and mitigation

CVE-2026-1287 is a SQL injection vulnerability in Django's FilteredRelation component that allows attackers to inject malicious SQL via crafted column aliases using control characters. It affects Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) may also be affected. The vulnerability was disclosed on February 3, 2026, and was reported by Solomon Kebede. It carries a CVSS v3.1 base score of 5.4 (Medium) per Red Hat, though GitHub's CVSS v4 assessment rates it 8.1 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is improper neutralization of special elements in SQL commands (CWE-89). The vulnerability exists in Django's FilteredRelation class, where column aliases are not properly sanitized against control characters. An attacker can craft a malicious dictionary and pass it via Python's **kwargs dictionary expansion to QuerySet methods including annotate(), aggregate(), extra(), values(), values_list(), and alias(), causing the injected control characters to break out of the intended column alias context and execute arbitrary SQL. Exploitation requires low privileges (an authenticated application user) and network access, with no user interaction needed (GitHub Advisory, Django Security Releases).

Successful exploitation can lead to unauthorized data access, data modification, or data deletion within the backend database, depending on the database user's permissions. Because the injection occurs through Django's ORM layer, any application endpoint that passes user-controlled data into the affected QuerySet methods with FilteredRelation is at risk. In worst-case scenarios with elevated database permissions, an attacker could achieve complete database compromise or potentially execute operating system commands via database-level features (GitHub Advisory, Red Hat Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.013% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory).

1. Identify target: Locate a Django application running an affected version (4.2 < 4.2.28, 5.2 < 5.2.11, or 6.0 < 6.0.2) that exposes endpoints accepting user-controlled input passed to QuerySet methods using FilteredRelation.
2. Craft malicious dictionary: Construct a Python dictionary where a key contains control characters (e.g., newline \n, carriage return \r, or null byte \x00) embedded within a column alias string intended for use with FilteredRelation.
3. Trigger dictionary expansion: Submit input to the application such that the crafted dictionary is expanded as **kwargs into one of the vulnerable QuerySet methods: annotate(), aggregate(), extra(), values(), values_list(), or alias().
4. Inject SQL payload: The control characters in the column alias break out of the alias context in the generated SQL query, allowing injection of arbitrary SQL clauses (e.g., UNION SELECT, subqueries, or conditional statements).
5. Extract or manipulate data: Use the injected SQL to exfiltrate sensitive data, modify records, or probe database structure, depending on the database user's privileges (GitHub Advisory, Django Security Releases).

• Logs: Unexpected SQL errors or unusual query structures in database logs containing control characters (newlines, carriage returns, null bytes) within column alias fields; Django application logs showing malformed ORM queries or database exceptions from annotate(), aggregate(), extra(), values(), values_list(), or alias() calls.
• Network: Unusual HTTP requests to application endpoints with parameters containing URL-encoded control characters (%0a, %0d, %00) in fields that map to QuerySet keyword arguments.
• Application Behavior: Unexpected query results, data leakage in API responses, or anomalous database read/write activity inconsistent with normal application usage patterns.

Upgrade Django to the patched versions: 6.0.2 (for 6.0.x), 5.2.11 (for 5.2.x), or 4.2.28 (for 4.2.x). Users on unsupported versions (5.0.x, 4.1.x, 3.2.x) should migrate to a supported and patched release. As an interim measure, validate and sanitize all user-controlled input before it is used in QuerySet keyword arguments, particularly when FilteredRelation is involved. Red Hat has issued errata for affected products including Ansible Automation Platform and Red Hat Satellite (Django Security Releases, Red Hat Bugzilla).

The Django security team published a blog post on February 3, 2026 announcing the security releases, and followed up on February 4, 2026 with a post on recent trends from the security team (Django Security Releases, Django Blog). Security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and CyberPress covered the vulnerability, with some framing it alongside related Django issues as "critical" SQL injection and DoS risks. The disclosure was also discussed on the oss-security mailing list and picked up by Linux distribution security advisories for Ubuntu, Debian, Fedora, SUSE, and Mageia (oss-security, Ubuntu Advisory).