CVE-2026-71282

Name of the Vulnerable Software and Affected Versions ChirpStack (affected versions not specified)

Description An authenticated user with device-list access can perform SQL injection when the SQLite backend is used. The issue occurs because the user-supplied tag key is interpolated directly into a raw SQL fragment using the format! macro within the get count() and list() functions in chirpstack/src/storage/device.rs, whereas only the tag value is safely bound. This flaw is specific to the SQLite backend; the PostgreSQL backend is not affected as it utilizes native JSONB containment operators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.