Manticore Search Multi-Statement Authorization Bypass

Manticore Search versions 27.0.0 through 28.4.3 contain an authorization vulnerability (CVE-2026-92796) where the application fails to correctly validate permissions for secondary statements within multi-statement SQL requests. An attacker with low-privileged, read-only access can exploit this flaw by appending additional SQL statements to a legitimate query. The underlying database engine processes the entire multi-statement request without re-verifying authorization for the secondary statements. This allows an attacker to bypass access controls and perform unauthorized read operations, specifically targeting sensitive internal credential tables to extract administrator password hashes. Successful exploitation allows for privilege escalation via hash cracking or credential reuse, enabling full administrative control over the Manticore Search instance. Defenders should prioritize updating to version 28.4.4 or later.

Impact

The vulnerability results in unauthorized access to sensitive data within the Manticore Search cluster. An attacker who successfully exfiltrates administrator password hashes can potentially gain full administrative access to the search service, leading to full data exposure or service disruption. This vulnerability affects any environment utilizing Manticore Search 27.0.0 through 28.4.3, regardless of the underlying operating system.

Recommendation

• Upgrade Manticore Search to version 28.4.4 or later to remediate CVE-2026-92796.
• Audit logs for suspicious, multi-statement SQL queries originating from read-only user accounts.
• Implement strict access control lists (ACLs) for database service accounts to limit the blast radius of compromised low-privileged credentials.