SQL Injection in Magistrala HTTP API

Magistrala versions prior to 1.0.0 contain a critical SQL injection vulnerability residing within the timescale-reader and postgres-reader HTTP API services. The vulnerability stems from improper handling of the format query parameter, which is interpolated directly into the SQL FROM clause without parameterization or identifier quoting. An authenticated attacker, including those with self-registered accounts, can manipulate this parameter to inject arbitrary subqueries. Because the application connects to the underlying PostgreSQL database with superuser privileges, successful exploitation allows an attacker to perform cross-tenant data exfiltration, extract sensitive credentials such as pg_shadow hashes, read or write arbitrary files on the filesystem, and execute arbitrary system commands by loading attacker-supplied shared objects. This vulnerability represents a significant risk as it grants an authenticated user full control over the database and the underlying operating system user hosting the PostgreSQL process.

Impact

Successful exploitation of CVE-2026-82028 allows for complete compromise of the Magistrala application data and the hosting server environment. Attackers can gain unauthorized access to data across all tenants, steal administrative credentials, and achieve remote code execution (RCE) with the privileges of the postgres OS user, leading to a full host takeover.

Recommendation

1. Upgrade Magistrala to version 1.0.0 or later immediately to patch the vulnerable API services.
2. Audit database access logs for unusual SQL queries involving the timescale-reader or postgres-reader endpoints that utilize unexpected subqueries or attempts to access pg_shadow.
3. Restrict the privileges of the PostgreSQL service account to adhere to the principle of least privilege, preventing the application from executing commands or file operations at the OS level.