CVE-2026-42717: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in VaultDweller Leyka

CVE-2026-42717 is an SQL Injection vulnerability (CWE-89) in VaultDweller's Leyka product, affecting versions up to 3.32.3. The vulnerability arises from improper neutralization of special elements in SQL commands, exploitable by an administrator with high privileges. The CVSS 3.1 score is 7.6 (high), with attack vector network, low attack complexity, high privileges required, no user interaction, and scope changed. The impact includes high confidentiality impact and low availability impact, with no integrity impact. There is no vendor advisory or patch information available to confirm remediation status.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to execute unauthorized SQL commands, potentially leading to unauthorized access to sensitive data and partial denial of service. The vulnerability does not affect integrity but impacts confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to SQL commands.