CVE-2026-82028

Magistrala before 1.0.0 contains a SQL injection flaw in the timescale-reader and postgres-reader HTTP API services: the user-supplied 'format' query parameter is interpolated directly into the FROM clause of a query without parameterization or identifier quoting. Any authenticated attacker — including one holding only a self-registered low-privilege account — can substitute arbitrary subqueries, enabling cross-tenant database reads, extraction of pg_shadow password hashes, arbitrary file read/write, and ultimately arbitrary code execution as the postgres OS user by loading attacker-supplied shared objects. The impact is amplified because the default PostgreSQL role configuration executes all injected SQL at superuser privilege. Self-hosted deployments of Magistrala prior to 1.0.0 with the reader APIs reachable to tenant users are affected. No public proof of concept exists, the flaw is not in the CISA KEV catalog, and no exploitation has been observed.

What to do: Upgrade Magistrala to version 1.0.0 or later, which remediates the injection in the reader services. Until patched, restrict network access to the timescale-reader and postgres-reader HTTP endpoints to trusted clients, disable open self-registration, and configure the reader services to use a non-superuser, least-privilege PostgreSQL role. Review database and application logs for anomalous 'format' parameter values, unexpected roles or shared objects, and rotate database credentials if compromise is suspected.