CVE-2026-41478: Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-24 · updated 2026-06-17
Weakness: CWE-89

Description

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5.

Affected products

saltcorn: before 1.4.6; from 1.5.0 before 1.5.6; 1.6.0-alpha0, 1.6.0-alpha1, 1.6.0-alpha10, 1.6.0-alpha11, 1.6.0-alpha12, 1.6.0-alpha13 (+16) — fixed in 1.4.6, 1.5.6

How to fix

Upgrade to a fixed version: saltcorn 1.4.6, 1.5.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41478 or the next vulnerability affects your stack