CVE-2025-71458 · Other
NO FIX YET · SEE WHAT TO DO
FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 have an unauthenticated SQL injection in the /linkinfo endpoint, reached through the source_se and dest_se query parameters. An attacker can use blind injection to read stored cloud storage credentials and token provider client secrets.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running FTS3 Web Monitoring 3.12.0 through 3.13.2 or 3.14.0 that expose the /linkinfo endpoint are exposed. The flaw needs no account, and the stored cloud credentials it reads are the main risk. Deployments on a patched version, or where the endpoint is not reachable, can skip it.
Not affected if endpoint-not-exposed, patched-version
Who cares cloud-storage, fts-monitoring, fts3, self-hosted
3.12.0 through 3.13.2 and 3.14.0./linkinfo endpoint reachable from the network in the deployed monitoring service.FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.