CVE-2026-19926: SQL Injection in Evergreen
A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded.
AI Analysis
Technical Summary
A SQL injection vulnerability (CVE-2026-19926) has been identified in Evergreen up to versions 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The affected component is an unknown function in the /osrf-gateway-v1 file of the open-ils.fielder OpenSRF Service. This vulnerability allows remote attackers to inject malicious SQL commands, potentially leading to unauthorized data access or manipulation. Publicly disclosed exploit code exists. The issue is fixed in versions 3.14.12, 3.15.12, 3.16.6, and 3.17-beta2.
Potential Impact
Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication. The CVSS 3.1 base score is 6.9 (medium severity), reflecting the moderate impact and ease of exploitation without privileges or user interaction.
Mitigation Recommendations
Upgrade affected Evergreen installations to version 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2 to remediate this SQL injection vulnerability. No other mitigations are indicated. Applying the official fix fully addresses the issue.
CVE-2026-19926: SQL Injection in Evergreen
Description
A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/evergreen-ils/evergreenRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A SQL injection vulnerability (CVE-2026-19926) has been identified in Evergreen up to versions 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The affected component is an unknown function in the /osrf-gateway-v1 file of the open-ils.fielder OpenSRF Service. This vulnerability allows remote attackers to inject malicious SQL commands, potentially leading to unauthorized data access or manipulation. Publicly disclosed exploit code exists. The issue is fixed in versions 3.14.12, 3.15.12, 3.16.6, and 3.17-beta2.
Potential Impact
Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication. The CVSS 3.1 base score is 6.9 (medium severity), reflecting the moderate impact and ease of exploitation without privileges or user interaction.
Mitigation Recommendations
Upgrade affected Evergreen installations to version 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2 to remediate this SQL injection vulnerability. No other mitigations are indicated. Applying the official fix fully addresses the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p2pw-xc8c-mvmj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19926"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a81d703bf8831d5394a1043
Added to database: 08/16/2026, 15:28:03 UTC
Last enriched: 08/24/2026, 11:19:34 UTC
Last updated: 09/07/2026, 10:52:07 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.