SQL Injection Vulnerability in Evergreen OpenSRF Service

A critical SQL injection vulnerability, identified as CVE-2026-19926, exists in the OpenSRF Service component of the Evergreen integrated library system. The flaw specifically affects the '/osrf-gateway-v1' endpoint and arises from improper sanitization of user-supplied input. Publicly available exploit code currently exists, enabling remote, unauthenticated attackers to manipulate database queries. This vulnerability allows for unauthorized data access or modification within the back-end database of the Evergreen implementation. Affected installations include versions 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. Organizations should upgrade to versions 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2 immediately to mitigate the risk.

Impact

Successful exploitation of this vulnerability permits unauthorized actors to interact with the underlying database, potentially leading to full exfiltration of library records, user information, or system configuration data. Given the remote and unauthenticated nature of the attack, this represents a high risk to availability and confidentiality for institutions deploying the Evergreen system.

Recommendation

• Upgrade Evergreen instances to version 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2 immediately to remediate CVE-2026-19926.
• Implement strict ingress filtering on the web server to restrict access to the '/osrf-gateway-v1' endpoint to only trusted internal IP ranges.
• Audit database access logs for unusual patterns or syntax typical of SQL injection attempts, such as UNION statements or comment sequences, originating from the web server process.