CVE-2026-34400
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
2th
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.
| CWE | CWE-89 |
| Vendor | alerta |
| Product | alerta |
| Published | Mar 31, 2026 |
| Last Updated | Apr 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for alerta alerta
Be the first to know when new critical vulnerabilities affecting alerta alerta are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
alerta / alerta
< 9.1.0
References
github.com: https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j github.com: https://github.com/alerta/alerta/pull/2040 github.com: https://github.com/alerta/alerta/pull/712 github.com: https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00 github.com: https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883 github.com: https://github.com/alerta/alerta/releases/tag/v9.1.0