CVE-2026-34400

moderate-risk
Published 2026-03-31

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

Do I need to act?

-
0.02% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Alerta Project

References (6)

Patch https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00
Patch https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883
Issue Tracking https://github.com/alerta/alerta/pull/2040
Issue Tracking https://github.com/alerta/alerta/pull/712
Product https://github.com/alerta/alerta/releases/tag/v9.1.0
Vendor Advisory https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j
37
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal