CVE-2026-71276

Name of the Vulnerable Software and Affected Versions Magistrala (formerly Mainflux) (affected versions not specified)

Description The message-readers API reads a format value from the HTTP query string in readers/api/http/transport.go without validation. This value is interpolated directly into raw SQL queries using fmt.Sprintf() within the PostgreSQL reader (readers/postgres/messages.go) and the TimescaleDB reader (readers/timescale/messages.go). This flaw allows an authenticated user with permissions to query channel messages to perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution by the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.