CVE-2026-71282

ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

View on CVE.org
Published Aug 5, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count() and list()) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format!() macro (`dsl::sql::<Bool>(&format!("device.tags->>'{}' =", k)).bind::<Text, _>(v)`), while only the tag VALUE is safely parameter-bound via Diesel's .bind(). An authenticated user with device-list access can inject SQL via a crafted tag key when the SQLite backend (chirpstack-sqlite package) is in use; the PostgreSQL backend is unaffected as it uses Diesel's native JSONB containment operator instead of raw SQL string formatting. ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.
Title ChirpStack - SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter
Type Values Removed Values Added
Title ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter ChirpStack - SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter
Type Values Removed Values Added
First Time appeared Chirpstack
Chirpstack chirpstack
Vendors & Products Chirpstack
Chirpstack chirpstack
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count() and list()) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format!() macro (`dsl::sql::<Bool>(&format!("device.tags->>'{}' =", k)).bind::<Text, _>(v)`), while only the tag VALUE is safely parameter-bound via Diesel's .bind(). An authenticated user with device-list access can inject SQL via a crafted tag key when the SQLite backend (chirpstack-sqlite package) is in use; the PostgreSQL backend is unaffected as it uses Diesel's native JSONB containment operator instead of raw SQL string formatting.
Title ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
TuranSec
Published
Updated
Aug 10, 2026, 11:47 AM
Reserved
Aug 5, 2026, 12:23 PM

View source JSON

Updated
Aug 5, 2026, 3:53 PM

JSON

Status
Deferred
Published
Aug 5, 2026, 1:24 PM
Modified
Aug 26, 2026, 5:13 PM

View source JSON

No data.

Updated
Aug 10, 2026, 9:00 PM

JSON