{"id":"CVE-2026-57190","kind":"vulnerability","aliases":["CVE-2026-57190"],"related":[],"title":"Asterisk: CEL logging can run arbitrary SQL from untrusted dialplan data","description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","summary":"Asterisk's cel_pgsql and cel_tds Channel Event Log backends can execute arbitrary SQL when untrusted data reaches the CEL eventtype column through the CELGenUserEvent dialplan application. An attacker who can influence that dialplan input can read or change the database behind the CEL logging.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","mssql","pbx","postgresql","runtime","telephony"],"not_affected_if":["default-config","no-cel-pgsql-or-cel-tds","no-celgenuserevent"],"how_to_check":"- Run `asterisk -V` to read the installed version and compare it with the fixed releases.\n- Check `cel.conf` and `modules.conf` for `cel_pgsql` or `cel_tds` being loaded and configured.\n- Search the dialplan for `CELGenUserEvent` and check whether its arguments come from caller or external input.","fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`, or Certified Asterisk to `20.7-cert11` or `22.8-cert3`.\n- Until upgraded, stop using `CELGenUserEvent` with untrusted values or disable the cel_pgsql and cel_tds backends.","status":"open","published_at":"2026-10-27T22:17:27+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","triaged_at":"2026-10-27T22:30:13+00:00","updated_at":"2026-10-27T22:30:13+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T22:30:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`, or Certified Asterisk to `20.7-cert11` or `22.8-cert3`.\n- Until upgraded, stop using `CELGenUserEvent` with untrusted values or disable the cel_pgsql and cel_tds backends.","reach":"unknown","title":"Asterisk: CEL logging can run arbitrary SQL from untrusted dialplan data","impact":"high","summary":"Asterisk's cel_pgsql and cel_tds Channel Event Log backends can execute arbitrary SQL when untrusted data reaches the CEL eventtype column through the CELGenUserEvent dialplan application. An attacker who can influence that dialplan input can read or change the database behind the CEL logging.","category":"runtime","nicknames":[],"who_cares":["asterisk","telephony","pbx","postgresql","mssql"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker runs arbitrary SQL against the CEL logging database","analyst_note":"Check the Asterisk security advisory for exact trigger conditions and whether an unauthenticated caller can reach CELGenUserEvent input.","how_to_check":"- Run `asterisk -V` to read the installed version and compare it with the fixed releases.\n- Check `cel.conf` and `modules.conf` for `cel_pgsql` or `cel_tds` being loaded and configured.\n- Search the dialplan for `CELGenUserEvent` and check whether its arguments come from caller or external input.","needs_analyst":true,"not_affected_if":["default-config","no-cel-pgsql-or-cel-tds","no-celgenuserevent"],"who_is_affected":"Only systems that load and configure the cel_pgsql or cel_tds CEL backend and call CELGenUserEvent in the dialplan with data that is not validated are exposed. Deployments that use other CEL backends or do not call CELGenUserEvent can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":3528,"output_tokens":742,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-57190':14A,17A '20.20.1':84C,166C '20.7':91C,173C '21.12.3':85C,167C '22.10.1':86C,168C '22.8':93C,175C '23.4.1':87C,169C 'administr':142C 'applic':51B,127C,159C 'arbitrari':6A,37B,110C 'asterisk':1A,18B,24B,70C,83C,90C,165C,172C 'attack':53B 'backend':34B,102C,134C 'behind':66B 'branch':76C 'call':144C 'cel':2A,26B,29B,44B,68B,103C,106C,120C,129C,132C 'celgenuserev':49B,125C,145C 'cert11':92C,174C 'cert3':94C,176C 'certifi':89C,171C 'chang':63B 'channel':31B,99C 'column':46B,122C 'configur':139C 'cve':12A,15A 'data':11A,41B,115C,154C 'databas':65B 'dialplan':10A,50B,58B,126C,148C 'ensur':150C 'event':32B,100C 'eventtyp':45B,121C 'exchang':77C 'execut':36B,112C 'fix':163C 'influenc':56B 'input':59B 'issu':161C 'load':137C 'log':3A,33B,69B,101C 'may':108C 'mssql':19B 'must':135C,143C 'open':73C 'pass':156C 'pbx':20B 'permit':109C 'pgsql':27B,104C,130C 'postgresql':21B,96C 'prior':81C 'privat':75C 'reach':42B 'read':61B 'run':5A 'runtim':22B 'set':117C 'sourc':74C 'sql':7A,38B,111C 'tds':30B,107C,133C 'tds/mssql':98C 'telephoni':23B,79C 'toolkit':80C 'untrust':9A,40B,114C 'valid':153C 'without':149C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load and configure the cel_pgsql or cel_tds CEL backend and call CELGenUserEvent in the dialplan with data that is not validated are exposed. Deployments that use other CEL backends or do not call CELGenUserEvent can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57190","severity":null,"published_at":"2026-10-27T22:17:27+00:00","modified_at":"2026-10-27T22:17:27+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","fetched_at":"2026-10-27T22:29:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}