What’s Vulnerable › Vulnerabilities

CVE-2026-71282: ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-08-26
• Weakness: CWE-89

Description

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.

Affected products

• chirpstack: through 4.19.0-test.5

References

• https://github.com/chirpstack/chirpstack
• https://github.com/chirpstack/chirpstack/blob/master/chirpstack/src/storage/device.rs

Get alerted when CVE-2026-71282 or the next vulnerability affects your stack