CVE-2026-41457 is a SQL injection vulnerability affecting OwnTone Server versions 28.4.0 through 29.0. The issue arises from improper sanitization of the query= and filter= parameters used in DAAP query and filter handling, specifically for integer-mapped DAAP fields. Attackers can inject malicious SQL code through these parameters, enabling them to bypass intended filters and gain unauthorized access to media library data stored in the backend database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality and integrity impact and limited availability impact.

Successful exploitation of this vulnerability allows an unauthenticated attacker to inject arbitrary SQL commands via DAAP query and filter parameters. This can lead to unauthorized access to media library data, potentially exposing sensitive information stored within the OwnTone Server database. The impact is limited to confidentiality and integrity with low severity on availability. There are no reports of active exploitation in the wild.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the OwnTone Server interface to trusted networks and monitor for unusual query parameter usage. Avoid exposing the service directly to untrusted networks.