CVE-2026-34400: 
Python vulnerability analysis and mitigation

CVE-2026-34400 is a SQL injection vulnerability in Alerta, an open-source monitoring tool, affecting all versions prior to 9.1.0. The vulnerability exists in the Query string search API (q= parameter), where the PostgreSQL query parser built SQL WHERE clauses by interpolating user-supplied search terms directly into SQL strings using Python f-strings. It was disclosed on March 31, 2026, with a patch released in version 9.1.0. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in the PostgreSQL backend's SearchTerm.__repr__() method, which used Python f-strings to interpolate user-supplied search terms directly into SQL query strings without sanitization or parameterization. An attacker could craft a malicious q= parameter value — for example, name:/''; DROP TABLE alerts;--/ — which would break out of the SQL string literal context and execute arbitrary SQL against the PostgreSQL database. The MongoDB backend was not affected, as its query parser outputs JSON dictionaries consumed by PyMongo's BSON encoder rather than constructing raw SQL strings. No authentication or special privileges are required to reach the vulnerable endpoint (GitHub Advisory, Fix PR #2040).

Successful exploitation allows an unauthenticated remote attacker to read, modify, or delete data in the underlying PostgreSQL database, which may contain sensitive monitoring alert data, credentials, and configuration. An attacker could also potentially escalate to operating system command execution via PostgreSQL features (e.g., COPY TO/FROM, pg_read_file), depending on database user privileges. The CVSS v3.1 score reflects high impact to confidentiality, integrity, and availability (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is remotely exploitable with no authentication, no user interaction, and low attack complexity, making it trivially weaponizable once targeted. The EPSS score is approximately 0.012% (0.000120), indicating currently low predicted exploitation probability. No threat actor attribution or CISA KEV catalog listing has been reported.

1. Reconnaissance: Identify internet-facing Alerta instances using Shodan, Censys, or similar tools by searching for the Alerta web UI or API endpoints. Confirm the backend is PostgreSQL (MongoDB deployments are not affected).
2. Identify the vulnerable endpoint: Locate the alerts query API, typically accessible at GET /api/alerts?q=<search_term>.
3. Craft a SQL injection payload: Construct a malicious q= parameter value that breaks out of the SQL string context. For example: name:/''; DROP TABLE alerts;--/ which the Postgres parser would render as: "name" ~* ''; DROP TABLE alerts;--'
4. Send the malicious request: Issue an HTTP GET request to the Alerta API with the crafted payload, e.g., GET /api/alerts?q=name:/'%3B+DROP+TABLE+alerts%3B--/
5. Achieve SQL execution: The injected SQL executes in the context of the PostgreSQL database user, enabling data exfiltration (SELECT), data manipulation (INSERT/UPDATE/DELETE), or further escalation depending on database permissions (GitHub Advisory, Fix PR #2040).

• Network: Unusual or malformed HTTP GET requests to /api/alerts with q= parameters containing SQL metacharacters such as single quotes ('), semicolons (;), SQL keywords (DROP, SELECT, INSERT, UNION, --), or regex-style payloads (e.g., name:/'...'/).
• Logs: Alerta API access logs showing repeated or anomalous requests to the /api/alerts endpoint with complex or encoded q= parameter values; PostgreSQL logs showing unexpected SQL syntax errors or unusual query patterns originating from the Alerta database user.
• Database: Unexpected schema changes (e.g., missing or altered tables), unauthorized data modifications, or new database objects (functions, roles) created by the Alerta service account.
• Process: Unexpected child processes spawned by the PostgreSQL server process (indicative of OS command execution via COPY or pg_exec if database privileges allow) (GitHub Advisory, Fix PR #2040).

Upgrade Alerta to version 9.1.0 or later, which replaces f-string interpolation with parameterized queries using %(name)s placeholders passed to psycopg2's cursor.execute(), fully preventing SQL injection through the ?q= parameter (GitHub Advisory, Fix Commit). If immediate patching is not possible, deploy a reverse proxy or WAF in front of the Alerta API to sanitize or block requests containing SQL metacharacters in the q= parameter. Additionally, restrict network-level access to the Alerta API to trusted IP ranges and review PostgreSQL database user privileges to apply the principle of least privilege.