CVE-2026-71276 is a SQL injection vulnerability (CWE-89) in Magistrala's message-readers API. The 'format' parameter from the HTTP query string is used unsafely in raw SQL queries constructed via fmt.Sprintf() in both PostgreSQL and TimescaleDB readers, allowing authenticated users to inject SQL commands. This occurs in readers/api/http/transport.go and readers/postgres/messages.go and readers/timescale/messages.go. The vulnerability enables unauthorized data access or manipulation with high confidentiality impact but limited integrity and availability impact. No known exploits are reported in the wild.

An authenticated user can exploit this vulnerability to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact). The integrity impact is low as the vulnerability primarily allows reading data, and availability impact is none. This could compromise the confidentiality of channel messages stored in PostgreSQL or TimescaleDB databases used by Magistrala.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable API to untrusted users or restrict access to trusted authenticated users only. Monitor vendor channels for updates and apply patches promptly once released.