CVE-2026-28438: CocoIndex SQL Injection Vulnerability in Doris Target Connector
Summary
CVE-2026-28438: CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements. Affects cocoindex versions < 0.3.34. Fixed in 0.3.34. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CocoIndex is an open-source data integration tool designed to facilitate the transfer of data between various sources and targets. It provides connectors for different databases and services, allowing users to perform operations like data ingestion and transformation. The Doris target connector is specifically used for writing data to Apache Doris, a distributed SQL database. However, a recent vulnerability has been identified in the Doris target connector, where it fails to properly validate table names, potentially leading to SQL injection attacks.
Vulnerability Detail
The vulnerability arises from the Doris target connector's lack of verification for the configured table name before executing SQL statements, particularly ALTER TABLE. If an untrusted source provides the table name, it can lead to SQL injection, allowing attackers to manipulate database queries and potentially gain unauthorized access to sensitive data or execute arbitrary commands.
How To Fix
Minimum fixed version
0.3.34
This is the first release that contains the fix.
pip install --upgrade "cocoindex==0.3.34"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Users are advised to ensure that table names used in the configuration of CocoIndex targets are valid. This can be done by:
- Using table names from trusted sources, such as fixed string literals.
- Validating any table names provided by untrusted sources (e.g., end users) before using them in the Doris target configuration.
Conclusion
The CocoIndex Doris target connector has a significant vulnerability that could lead to SQL injection attacks due to improper validation of table names. Users are strongly encouraged to update to the patched version 0.3.34 and implement validation measures for table names to protect their applications.
See every vulnerability recorded for cocoindex →
FAQ
The vulnerability has a CVSS score of 8.0, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands, potentially leading to data breaches or unauthorized access to sensitive information.
Yes, the vulnerability has been fixed in CocoIndex version 0.3.34. Users should upgrade to this version or later.
If an immediate upgrade is not possible, ensure that all table names are validated and come from trusted sources to mitigate the risk of SQL injection.
