CVE-2026-34400: Alerta-server SQL Injection Vulnerability in Query String Syntax API
Summary
CVE-2026-34400: alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API. Affects alerta-server versions < 9.1.0. Fixed in 9.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alerta-server is an open-source monitoring tool that allows users to manage and respond to alerts from various sources. It provides a flexible API for querying alerts, making it easier for developers to integrate alert management into their applications. However, the package has been found to have a vulnerability that could lead to SQL injection attacks, specifically through its Query String Syntax API.
Vulnerability Detail
The vulnerability arises from the way the Query String search API (q=) processes user-supplied search terms. The Postgres query parser constructs WHERE clauses by directly interpolating these terms into SQL strings using f-strings. This practice exposes the application to SQL injection attacks, allowing malicious users to manipulate database queries and potentially gain unauthorized access to sensitive data.
How To Fix
Latest published version: 9.1.0 as of 23 Oct 2026
pip install --upgrade "alerta-server==9.1.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to deploy a proxy in front of the Alerta API that sanitizes the q= parameter to prevent SQL injection attempts.
Conclusion
The CVE-2026-34400 vulnerability in the alerta-server package poses a significant risk due to its potential for SQL injection attacks through the Query String Syntax API. Users are strongly advised to upgrade to version 9.1.0 or later to mitigate this risk. For those unable to upgrade immediately, implementing a proxy to sanitize input can serve as a temporary solution.
See every vulnerability recorded for alerta-server →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can lead to unauthorized access to data, data manipulation, or even complete database compromise.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner. This tool allows you to monitor and alert in real-time for open-source vulnerabilities without requiring access to the code or installation.
If you are unable to upgrade to version 9.1.0 or later, it is recommended to implement a proxy that sanitizes the q= parameter to mitigate the risk of SQL injection attacks.
No, the MongoDB backend is not affected by this SQL injection vulnerability. The issue is specific to the Postgres query parser.
Parameterized queries are a method of structuring SQL queries that separates SQL code from user input. This approach helps prevent SQL injection by ensuring that user input is treated as data rather than executable code.
References
Related vulnerabilities
Recent vulnerabilities recorded for alerta-server.
