CVE-2026-40906: Electric: SQL Injection via ORDER BY Parameter in Shape API

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-21 · updated 2026-07-15
Weakness: CWE-89

Description

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

Affected products

Electric Sync-Service: from 1.1.12 before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: Electric Sync-Service 1.5.0. Check the vendor advisory for mitigations.

References

https://github.com/electric-sql/electric/pull/4081
https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj
https://access.redhat.com/security/cve/CVE-2026-40906
https://bugzilla.redhat.com/show_bug.cgi?id=2460291
https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hj
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40906.json

Get alerted when CVE-2026-40906 or the next vulnerability affects your stack