Description

Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-20T12:16:31.763Z",
  "pubdate": "2026-08-20T12:16:31.763Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in Capella versions <= 2.5.5. This security flaw allows remote, unauthenticated attackers to supply maliciously crafted input that is improperly sanitized or parameterized before being concatenated into database queries executed by the underlying application backend.\nThe successful exploitation of this vulnerability grants malicious actors the ability to manipulate the structure of database queries, leading to unauthorized data access, information disclosure, data manipulation, and potentially complete compromise of the underlying database management system and hosting infrastructure.\nThe risk implication is critical, as the vulnerability requires no prior authentication, user interaction, or specialized privileges, lowering the barrier to entry for potential attackers scanning for vulnerable Capella deployments exposed to the network. Remediation requires updating the affected product to a secure version once released or applying rigorous input validation and parameterized query enforcement at the application layer.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in SQL commands within the vulnerable component of Capella <= 2.5.5. Specifically, user-supplied input parameters received via HTTP requests are directly concatenated into dynamic SQL queries or processed by insecure query builder methods without adequate sanitization, escaping, or the use of parameterized statements (prepared statements).\nBecause the affected component is accessible over the network without requiring any authentication or session tokens, an unauthenticated attacker can initiate the attack flow by sending crafted HTTP GET or POST requests containing malicious SQL payloads embedded within vulnerable parameters.\nUpon receiving the request, the application passes the tainted input directly to the database abstraction layer. The database engine interprets the attacker-supplied input as executable SQL commands rather than literal data strings. This alters the intended logic of the database query.\nDepending on the injection vector, the attack flow may manifest as In-Band SQL Injection (utilizing UNION-based techniques or Error-based methods to extract data directly in the HTTP response), or Inferential SQL Injection (such as Blind Boolean-based or Time-based blind attacks) to deduce database contents character by character.\nPost-exploitation impact includes the potential extraction of sensitive database contents such as administrative credentials, user personal identifiable information, and internal application data. In misconfigured database environments running with elevated privileges (e.g., database superuser or administrative roles), the attacker may leverage advanced database functionalities to read or write local files on the underlying operating system or execute operating system commands, resulting in full system compromise."
}