{"id":"CVE-2026-129171","kind":"vulnerability","aliases":["CVE-2026-129171"],"related":[],"title":"NginxPulse: unauthenticated SQL injection lets remote attackers read database and files","description":"NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.","summary":"NginxPulse versions 1.5.0 before 1.6.26 let anyone on the internet inject SQL through the id and locationType parameters of the /api/stats/:type endpoint without logging in. An attacker can read database contents through error messages and, when PostgreSQL superuser functions are available, read or write files on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nginxpulse","package","postgresql","self-hosted"],"not_affected_if":["not-network-exposed","patched-version"],"how_to_check":"- Check the installed NginxPulse version and confirm whether it is `1.5.0` up to but not including `1.6.26`.\n- Look for reachable instances exposing the `/api/stats/` endpoint.","fix":"- Upgrade NginxPulse to `1.6.26` or later.","status":"open","published_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","triaged_at":"2026-11-13T18:51:18+00:00","updated_at":"2026-11-13T18:51:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T18:51:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NginxPulse to `1.6.26` or later.","reach":"internet","title":"NginxPulse: unauthenticated SQL injection lets remote attackers read database and files","impact":"high","summary":"NginxPulse versions 1.5.0 before 1.6.26 let anyone on the internet inject SQL through the id and locationType parameters of the /api/stats/:type endpoint without logging in. An attacker can read database contents through error messages and, when PostgreSQL superuser functions are available, read or write files on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nginxpulse","self-hosted","postgresql"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Database contents read and server files read or written remotely","analyst_note":"","how_to_check":"- Check the installed NginxPulse version and confirm whether it is `1.5.0` up to but not including `1.6.26`.\n- Look for reachable instances exposing the `/api/stats/` endpoint.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","not-network-exposed"],"who_is_affected":"NginxPulse deployments between 1.5.0 and 1.6.26 that are reachable from the network are exposed, since the flaw needs no account. Instances behind a network restriction or running a patched release can skip it. The sources do not say whether the database user's superuser role is commonly granted in default setups.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000743,"input_tokens":4618,"output_tokens":562,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129171':14A,17A '-2026':13A,16A '/api/stats':44B,97C '1.5.0':26B,74C '1.6.26':28B,76C 'allow':84C 'anyon':30B 'append':88C 'attack':7A,51B,86C,99C 'avail':65B 'base':112C 'close':101C 'contain':77C 'content':55B,117C 'cve':12A,15A 'databas':9A,54B,116C 'endpoint':46B 'error':57B,111C 'error-bas':110C 'file':11A,69B,123C 'function':63B,127C 'host':23B 'id':38B,92C 'identifi':107C 'inject':4A,34B,81C 'internet':33B 'let':5A,29B 'locationtyp':40B,94C 'log':48B 'messag':58B 'name':106C 'nginxpuls':1A,18B,24B,73C 'output':113C 'packag':19B 'paramet':41B,95C 'postgresql':20B,61B,125C 'quot':103C 'read':8A,53B,66B,115C,119C 'remot':6A,85C 'self':22B 'self-host':21B 'server':72B,122C 'sql':3A,35B,80C,89C 'superus':62B,126C 'tabl':105C 'table-nam':104C 'type':45B,98C 'unauthent':2A,79C 'use':109C 'version':25B 'via':90C,124C 'vulner':82C 'without':47B 'write':68B,121C","nicknames":[],"mitigations":[],"who_affected":"NginxPulse deployments between 1.5.0 and 1.6.26 that are reachable from the network are exposed, since the flaw needs no account. Instances behind a network restriction or running a patched release can skip it. The sources do not say whether the database user's superuser role is commonly granted in default setups.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","nginxpulse","package","postgresql","selfhosted"],"campaign_type":null,"search_a":"'-129171':14A,17A '-2026':13A,16A 'attack':7A 'cve':12A,15A 'databas':9A 'file':11A 'inject':4A 'let':5A 'nginxpuls':1A 'read':8A 'remot':6A 'sql':3A 'unauthent':2A","search_b":"'/api/stats':44B '1.5.0':26B '1.6.26':28B 'anyon':30B 'attack':51B 'avail':65B 'content':55B 'databas':54B 'endpoint':46B 'error':57B 'file':69B 'function':63B 'host':23B 'id':38B 'inject':34B 'internet':33B 'let':29B 'locationtyp':40B 'log':48B 'messag':58B 'nginxpuls':18B,24B 'packag':19B 'paramet':41B 'postgresql':20B,61B 'read':53B,66B 'self':22B 'self-host':21B 'server':72B 'sql':35B 'superus':62B 'type':45B 'version':25B 'without':47B 'write':68B","search_c":"'/api/stats':97C '1.5.0':74C '1.6.26':76C 'allow':84C 'append':88C 'attack':86C,99C 'base':112C 'close':101C 'contain':77C 'content':117C 'databas':116C 'error':111C 'error-bas':110C 'file':123C 'function':127C 'id':92C 'identifi':107C 'inject':81C 'locationtyp':94C 'name':106C 'nginxpuls':73C 'output':113C 'paramet':95C 'postgresql':125C 'quot':103C 'read':115C,119C 'remot':85C 'server':122C 'sql':80C,89C 'superus':126C 'tabl':105C 'table-nam':104C 'type':98C 'unauthent':79C 'use':109C 'via':90C,124C 'vulner':82C 'write':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129171","severity":null,"published_at":"2026-11-13T18:17:42+00:00","modified_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","fetched_at":"2026-11-13T18:49:31+00:00","note":null}],"documents":[{"id":148630,"url":"https://github.com/likaia/nginxpulse/commit/f9416bea3be892a394cd24a6d4a2afbd8397e926","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148631,"url":"https://www.vulncheck.com/advisories/nginxpulse-1.5.0-before-1.6.26-sql-injection-via-api-stats-type","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}