---
id: "CVE-2026-115328"
kind: "vulnerability"
aliases: ["CVE-2026-115328"]
title: "JSON-SCADA: SQL injection in opcApi lets users alter historian data"
severity: "high"
cvss: 8.8
epss: 0.0029
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["historian", "industrial-control", "json-scada", "node.js", "other", "scada"]
not_affected_if: ["no-authenticated-users", "version-0.65-alpha-or-later"]
published_at: "2026-10-22T11:17:51+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115328", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115328", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# JSON-SCADA: SQL injection in opcApi lets users alter historian data

JSON-SCADA before 0.65-alpha has a SQL injection in its opcApi() handler, reached through NodeId.Id, StartTime and EndTime values in HistoryReadRequest. An logged-in user can read, modify or delete historian data for every location, regardless of role.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed JSON-SCADA version and confirm it is below 0.65-alpha.

## Fix

Upgrade JSON-SCADA to 0.65-alpha or later.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115328
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115328

## From the sources

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_