Magistrala's message-readers API improperly handles input from HTTP query strings by inserting it directly into SQL queries without validation or sanitization. This occurs in the PostgreSQL reader (readers/postgres/messages.go) and TimescaleDB reader (readers/timescale/messages.go) via fmt.Sprintf, enabling SQL injection (CWE-89). The vulnerability requires authentication and affects the ability to query channel messages, potentially allowing an attacker to execute arbitrary SQL commands with high confidentiality impact but limited integrity and no availability impact.

An authenticated user querying channel messages can exploit this vulnerability to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive data (high confidentiality impact). The integrity impact is low and availability impact is none according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious query patterns. Avoid using unvalidated input directly in SQL queries and consider implementing parameterized queries or prepared statements to prevent SQL injection.