Admin REST API: SQL injection in administrative interface (CVE-2026-2613)
The Admin REST API is vulnerable to blind SQL injection due to improper input sanitization, allowing an authenticated administrator to extract database information or disrupt service.
CVE search metadata
CVE search record: CVE-2026-2613. Severity: high. CVSS: 8.7. KEV: no. Product: Admin REST API. Brief: Admin REST API: SQL injection in administrative interface (CVE-2026-2613). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-2613-sql-injection/
Triage facts
Revision 1- Applicability
- Admin REST API
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 11:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-2613 is a SQL injection vulnerability in the Admin REST API. The API fails to adequately sanitize user-supplied input before incorporating it into SQL statements. Exploitation requires administrator privileges, allowing an attacker to execute blind SQL injection attacks to infer database contents or impact database service availability.
Impact
Successful exploitation allows for unauthorized database information disclosure and potential service disruption by manipulating SQL query structures.
Recommendation
- Inventory systems utilizing the Admin REST API to assess exposure.
- Prioritize application-level patching or vendor-issued updates to the Admin REST API to resolve input sanitization deficiencies.
- Review and restrict administrative access, as the vulnerability requires existing administrative privileges to exploit.
- Enable database query logging to detect anomalous query structures originating from the API service account.
Immediate actions
Inventory all instances of the Admin REST API and confirm if patches are available from the software vendor.
Threat Hunt
Monitor database server logs for syntax errors or anomalous query patterns (e.g., unexpected UNION, WAITFOR, or SLEEP commands) originating from the web application server identity.
Data: Database query logs, Web server access logs
Mitigations
Restrict access to the Admin REST API to authorized management subnets only.
CVE-2026-2613