CVE-2026-34400 alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version...

CVE-2026-34400

CVE-2026-34400 affects Alerta (alerta-server) prior to version 9.1.0. The vulnerability is in the Query string search API (q=) where user-supplied search terms were interpolated into SQL strings via f-strings in the PostgreSQL query parser, enabling SQL injection in WHERE clauses. The issue has b...