UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to… (CVE-2026-82039)
UTMStack versions before 11.2.16 have a SQL injection vulnerability in the UtmAssetGroupService.searchQueryBuilder() method. Authenticated attackers can exploit this flaw by sending crafted requests to the GET /api/utm-asset-groups/searchGroupsByFilter endpoint, injecting arbitrary SQL commands. This vulnerability allows execution of SQL with DBA privileges, potentially leading to full database read, data modification, and filesystem access.
AI Analysis
Technical Summary
The vulnerability in UTMStack prior to version 11.2.16 exists in the UtmAssetGroupService.searchQueryBuilder() function, where unsanitized user input (assetType and groupName) is inserted into a native PostgreSQL query using String.format(). This improper input handling enables authenticated attackers to perform SQL injection via the GET /api/utm-asset-groups/searchGroupsByFilter endpoint. Successful exploitation grants attackers DBA-level SQL execution capabilities, allowing comprehensive database access and possible filesystem interaction.
Potential Impact
Exploitation of this vulnerability allows authenticated attackers to execute arbitrary SQL commands with DBA privileges. This can lead to complete database compromise including reading sensitive data, modifying or deleting data, and potentially accessing the underlying filesystem. The high CVSS score (8.8) reflects the critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in UTMStack version 11.2.16. Users should upgrade to version 11.2.16 or later to remediate this vulnerability. Until the upgrade is applied, restrict access to the affected API endpoint to trusted users only and monitor for suspicious activity. Patch status is confirmed by the version information in the description.
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to… (CVE-2026-82039)
Description
UTMStack versions before 11.2.16 have a SQL injection vulnerability in the UtmAssetGroupService.searchQueryBuilder() method. Authenticated attackers can exploit this flaw by sending crafted requests to the GET /api/utm-asset-groups/searchGroupsByFilter endpoint, injecting arbitrary SQL commands. This vulnerability allows execution of SQL with DBA privileges, potentially leading to full database read, data modification, and filesystem access.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/utmstack/utmstackRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in UTMStack prior to version 11.2.16 exists in the UtmAssetGroupService.searchQueryBuilder() function, where unsanitized user input (assetType and groupName) is inserted into a native PostgreSQL query using String.format(). This improper input handling enables authenticated attackers to perform SQL injection via the GET /api/utm-asset-groups/searchGroupsByFilter endpoint. Successful exploitation grants attackers DBA-level SQL execution capabilities, allowing comprehensive database access and possible filesystem interaction.
Potential Impact
Exploitation of this vulnerability allows authenticated attackers to execute arbitrary SQL commands with DBA privileges. This can lead to complete database compromise including reading sensitive data, modifying or deleting data, and potentially accessing the underlying filesystem. The high CVSS score (8.8) reflects the critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in UTMStack version 11.2.16. Users should upgrade to version 11.2.16 or later to remediate this vulnerability. Until the upgrade is applied, restrict access to the affected API endpoint to trusted users only and monitor for suspicious activity. Patch status is confirmed by the version information in the description.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2c66-2qvh-84xr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-82039"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ac139baa43b0b3b89d69d45
Added to database: 10/03/2026, 17:22:02 UTC
Last enriched: 10/03/2026, 17:42:52 UTC
Last updated: 10/03/2026, 22:00:33 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.