Live › vulnerability › CVE-2026-57190
Go to dashboardAsterisk's cel_pgsql and cel_tds Channel Event Log backends can execute arbitrary SQL when untrusted data reaches the CEL eventtype column through the CELGenUserEvent dialplan application. An attacker who can influence that dialplan input can read or change the database behind the CEL logging.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 22:29 UTC. All times on this page are UTC.
Only systems that load and configure the cel_pgsql or cel_tds CEL backend and call CELGenUserEvent in the dialplan with data that is not validated are exposed. Deployments that use other CEL backends or do not call CELGenUserEvent can skip it.
No product ranges from the sources yet.
asterisk -V to read the installed version and compare it with the fixed releases.cel.conf and modules.conf for cel_pgsql or cel_tds being loaded and configured.CELGenUserEvent and check whether its arguments come from caller or external input.20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk to 20.7-cert11 or 22.8-cert3.CELGenUserEvent with untrusted values or disable the cel_pgsql and cel_tds backends.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57190")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.