CVE-2026-57190

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description The PostgreSQL and TDS/MSSQL Channel Event Log backends cel pgsql and cel tds may permit arbitrary SQL execution. This occurs when untrusted data is set in the CEL eventtype column via the CELGenUserEvent() dialplan application. The issue requires the cel pgsql or cel tds backend to be loaded and configured, and the administrator to call CELGenUserEvent() in the dialplan without validating the data passed to the application.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update Certified Asterisk to version 20.7-cert11 Update Certified Asterisk to version 22.8-cert3 As a temporary workaround, restrict the use of the CELGenUserEvent() function or ensure only validated data is passed to it.