J
member badge
Johannes Rudolph
  • Issue:
    SQL Injection (CWE-89) in meshStack
  • Criticality:
    Medium (CVSS 3.1 base score 6.5)
  • Affected meshStacks:
    All meshStack versions before v2026.41.1
  • Impact:
    A SQL injection vulnerability in meshStack allowed authenticated users to read data they are not authorized to read via improper input validation. The vulnerability was limited to authenticated users, isolated to your meshStack instance and provided only read access. As meshStack stores secrets and credentials in encrypted or hashed form, no plaintext secrets or credentials could be exposed. We have no indication from our logs that the vulnerability was exploited.
  • Recommended Action:
    Upgrade meshStack to v2026.41.1 at the next maintenance window. meshStack SaaS customers do not have to take action, as we will upgrade your meshStack automatically at the next maintenance window.
In line with our coordinated disclosure policy, we will not provide further technical details until this patch has been applied to all meshStack instances. We will then add them to this advisory.
Additional Details
We found the issue during an internal security audit.