What’s Vulnerable › Vulnerabilities

CVE-2026-21856: Tarkov Data Manager has Authenticated SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-07 · updated 2026-06-17
• Weakness: CWE-89

Description

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time based blind SQL injection vulnerability in the webhook edit and scanner api endpoints that allow an authenticated attacker to execute arbitrary SQL queries against the MySQL database. Commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8 contains a patch.

Affected products

• the-hideout tarkov-data-manager: before 2026-01-02 — fixed in 2026-01-02

How to fix

Upgrade to a fixed version: the-hideout tarkov-data-manager 2026-01-02. Check the vendor advisory for mitigations.

References

• https://github.com/the-hideout/tarkov-data-manager/commit/9bdb3a75a98a7047b6d70144eb1da1655d6992a8
• https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-4gcx-ghwc-rc78

Get alerted when CVE-2026-21856 or the next vulnerability affects your stack