CVE-2026-1312: 
Django vulnerability analysis and mitigation

CVE-2026-1312 is a SQL injection vulnerability in Django's .QuerySet.order_by() method, where column aliases containing periods can be exploited when the same alias is used with dictionary expansion in FilteredRelation. It affects Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) may also be affected but were not formally evaluated. The vulnerability was disclosed on February 3, 2026, and was reported by Solomon Kebede. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements in SQL commands (CWE-89). Specifically, Django's ORM fails to adequately sanitize column aliases that contain periods when those aliases are passed via dictionary expansion into FilteredRelation and subsequently used in .QuerySet.order_by(). An attacker with low-level authenticated access can craft a malicious dictionary where a key containing a period in the alias position is expanded into the query, causing the ORM to emit unsanitized SQL. The attack vector is network-based, requires low privileges, and no user interaction, with low attack complexity (GitHub Advisory, Django Security Releases).

Successful exploitation allows a low-privileged attacker to inject arbitrary SQL into database queries, potentially enabling unauthorized read access to sensitive data (confidentiality impact) and unauthorized modification of database records (integrity impact). Availability is not directly impacted per the CVSS assessment, though chained exploitation could lead to broader database compromise. Applications using Django's ORM with user-influenced order_by() and FilteredRelation with dictionary expansion are at risk, and the scope of impact depends on the underlying database permissions granted to the Django application user (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.013% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection plugins are available from Nessus (IDs: 297744, 298044, 298350, 299630, 300515, 300516, 300641, 301388, 303901, 303903) and Qualys (IDs: 6031874, 6047774) (Feedly).

1. Identify target: Locate a Django application (versions 4.2.x < 4.2.28, 5.2.x < 5.2.11, or 6.0.x < 6.0.2) that uses .QuerySet.order_by() in conjunction with FilteredRelation and accepts user-influenced input for ordering or filtering parameters.
2. Obtain low-privileged access: Authenticate to the application with any valid low-privileged account, as the vulnerability requires PR:L (low privileges required).
3. Craft malicious payload: Construct a dictionary where a key contains a period in a column alias position (e.g., {'alias.injected_sql': ...}), designed to be passed via dictionary expansion (**kwargs) into a FilteredRelation call.
4. Trigger vulnerable code path: Submit a request that causes the application to invoke .QuerySet.order_by() with the crafted alias, causing Django's ORM to incorporate the unsanitized alias into the generated SQL ORDER BY clause.
5. Extract or manipulate data: Leverage the injected SQL to enumerate database schema, extract sensitive records, or modify data depending on the database user's permissions (GitHub Advisory, Django Security Releases).

• Logs: Django application logs or database query logs showing unexpected SQL syntax in ORDER BY clauses, particularly with column aliases containing periods or SQL keywords; unusual database error messages related to malformed ORDER BY expressions.
• Network: Repeated authenticated HTTP requests to endpoints that trigger order_by() or FilteredRelation logic, especially with unusual or encoded parameter values in ordering/filtering fields.
• Application Behavior: Unexpected query results, database errors surfaced to users, or anomalous data retrieval patterns suggesting unauthorized data access via injected SQL conditions.

Upgrade Django to the patched versions: 6.0.2, 5.2.11, or 4.2.28 depending on the deployed branch (Django Security Releases, GitHub Advisory). For applications running unsupported versions (5.0.x, 4.1.x, 3.2.x), upgrade to a supported and patched branch immediately. As a short-term workaround, audit and restrict application code that passes user-controlled data into .QuerySet.order_by() combined with FilteredRelation and dictionary expansion, and implement strict allowlisting of permitted column aliases. Red Hat has issued errata for affected products including Ansible Automation Platform and Red Hat Satellite (Red Hat Bugzilla).

The Django project published a security blog post on February 3, 2026, announcing the releases and crediting Solomon Kebede for responsible disclosure (Django Security Releases). A follow-up post on February 4, 2026, discussed recent trends from the Django security team (Django Security Blog). Security news outlets including SecurityOnline, GBHackers, CyberSecurityNews, and CyberPress covered the vulnerability, with headlines emphasizing SQL injection and DoS risks in Django. The vulnerability was also picked up in The Hacker News weekly recap and received coverage across Linux distribution security channels (Ubuntu, Debian, Fedora, SUSE, Mageia), reflecting broad community awareness and rapid patch adoption.