CVE-2026-79303

kaiten versions from 57.192.20 up to (but not including) 57.214.26 are vulnerable to SQL injection because dynamic SQL statements are constructed without adequate input validation and without parameterized queries or stored procedures. An attacker can inject crafted input into a vulnerable parameter, causing the application to execute attacker-influenced SQL against the backend database. Successful exploitation could allow reading or modifying sensitive data, bypassing authentication, or, depending on database configuration, executing further attacks against the underlying server. All deployments running the affected version range are exposed wherever the vulnerable input is reachable, and a public proof-of-concept is available on GitHub, lowering the barrier for attackers. The flaw is not yet in CISA's Known Exploited Vulnerabilities catalog and no confirmed in-the-wild exploitation is documented, but the public PoC means active abuse is plausible.

What to do: Upgrade kaiten to version 57.214.26 or later as soon as it is available. Until patched, restrict access to the affected functionality and apply WAF or database-layer rules to filter common SQL injection patterns. Review database and application logs for anomalous queries or unexpected data access that could indicate exploitation attempts.