{"id":"CVE-2026-108087","kind":"vulnerability","aliases":["CVE-2026-108087"],"related":[],"title":"Apache Cocoon: SQL injection via SQL processor and logicsheets, no fix","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon.\n\n\n\nThis issue affects Apache Cocoon: all versions.\n\n\n\nMissing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","summary":"Apache Cocoon fails to sanitize input passed through its SQL processor and sql:/esql: logicsheets, so an attacker can inject arbitrary SQL. The project is retired and no fixed release will be published.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-cocoon","java","other","self-hosted"],"not_affected_if":["cocoon-not-deployed","no-sql-logicsheets"],"how_to_check":"- Check whether Apache Cocoon is deployed anywhere, for example by searching the application for `cocoon` in its libraries or web configuration.\n- Check whether the SQL processor or the `sql:` and `esql:` logicsheets are used in the pipelines.","fix":"- No fixed version will be released; move off Apache Cocoon to a maintained alternative.\n- Until then, restrict access to the instance to trusted users only.","status":"open","published_at":"2026-10-20T11:17:16+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T05:04:53+00:00","updated_at":"2026-10-25T05:04:53+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:04:53Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version will be released; move off Apache Cocoon to a maintained alternative.\n- Until then, restrict access to the instance to trusted users only.","reach":"unknown","title":"Apache Cocoon: SQL injection via SQL processor and logicsheets, no fix","impact":"high","summary":"Apache Cocoon fails to sanitize input passed through its SQL processor and sql:/esql: logicsheets, so an attacker can inject arbitrary SQL. The project is retired and no fixed release will be published.","category":"other","nicknames":[],"who_cares":["apache-cocoon","java","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary SQL against the backing database","analyst_note":"","how_to_check":"- Check whether Apache Cocoon is deployed anywhere, for example by searching the application for `cocoon` in its libraries or web configuration.\n- Check whether the SQL processor or the `sql:` and `esql:` logicsheets are used in the pipelines.","needs_analyst":false,"not_affected_if":["cocoon-not-deployed","no-sql-logicsheets"],"who_is_affected":"Teams running Apache Cocoon with the SQL processor or the sql:/esql: logicsheets enabled are exposed, since untrusted input can reach SQL statements. Teams that do not run Cocoon, or that do not use those logicsheets, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000614,"input_tokens":3431,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108087':14A,17A '-2026':13A,16A '/esql':39B,99C 'access':127C 'affect':80C,138C 'allow':89C 'altern':124C 'apach':1A,19B,26B,76C,81C 'apache-cocoon':18B 'arbitrari':46B,90C 'assign':61C 'attack':43B 'cocoon':2A,20B,27B,77C,82C 'command':71C 'cve':12A,15A 'element':66C 'fail':28B 'find':122C 'fix':11A,54B,115C 'host':25B 'improp':62C 'inject':4A,45B,73C,92C 'input':31B,86C 'instanc':130C 'issu':79C,117C 'java':21B 'logicsheet':9A,40B,100C 'longer':143C 'maintain':147C 'miss':85C 'neutral':63C 'note':134C 'pass':32B 'plan':109C 'processor':7A,36B,96C 'product':139C 'project':49B,103C 'publish':58B 'recommend':120C 'releas':55B,111C 'restrict':126C 'retir':51B,105C 'sanit':30B,87C 'self':24B 'self-host':23B 'special':65C 'sql':3A,6A,35B,38B,47B,70C,72C,91C,95C,98C 'support':144C 'trust':132C 'unsupport':59C 'use':67C 'user':118C,133C 'version':84C,113C 'via':5A 'vulner':74C,136C 'would':88C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Cocoon with the SQL processor or the sql:/esql: logicsheets enabled are exposed, since untrusted input can reach SQL statements. Teams that do not run Cocoon, or that do not use those logicsheets, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108087","severity":null,"published_at":"2026-10-20T11:17:16+00:00","modified_at":"2026-10-20T19:34:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}