CVE-2026-82028 is a high-severity SQL injection vulnerability affecting absmach's Magistrala product versions prior to 1.0.0. The flaw exists in the timescale-reader and postgres-reader HTTP API services where the format query parameter is unsafely interpolated into the SQL FROM clause without parameterization or identifier quoting. This enables authenticated attackers, including those with self-registered accounts, to inject arbitrary SQL commands executed with superuser privileges. Consequences include cross-tenant data access, extraction of pg_shadow password hashes, arbitrary file read/write, and remote code execution by loading attacker-supplied shared objects as the postgres OS user.

Exploitation allows attackers to bypass tenant isolation, access sensitive database contents including password hashes, manipulate files on the server, and execute arbitrary code with superuser privileges on the underlying operating system. This represents a critical compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API services to trusted users only and monitor for suspicious activity. Avoid using vulnerable versions of Magistrala prior to 1.0.0 in production environments.