CVE-2026-41422 - Vulnerability Analysis

Overview

Daptin < 0.11.4 contains a SQL injection caused by unvalidated column and group parameters in /aggregate/:typename endpoint passed to goqu.L(), letting authenticated users inject arbitrary SQL expressions.

Severity & Score

Impact

Authenticated users can inject arbitrary SQL expressions, potentially leading to data leakage or modification.

Mitigation

Upgrade to version 0.11.4 or later.

References

• https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv
• https://github.com/daptin/daptin/releases/tag/v0.11.4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner