---
id: "CVE-2026-57190"
kind: "vulnerability"
aliases: ["CVE-2026-57190"]
title: "Asterisk: CEL logging can run arbitrary SQL from untrusted dialplan data"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["asterisk", "mssql", "pbx", "postgresql", "runtime", "telephony"]
not_affected_if: ["default-config", "no-cel-pgsql-or-cel-tds", "no-celgenuserevent"]
published_at: "2026-10-27T22:17:27+00:00"
first_seen_at: "2026-10-27T22:29:29+00:00"
updated_at: "2026-10-27T22:30:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57190", "first_seen_at": "2026-10-27T22:29:29+00:00"}]
---

# Asterisk: CEL logging can run arbitrary SQL from untrusted dialplan data

Asterisk's cel_pgsql and cel_tds Channel Event Log backends can execute arbitrary SQL when untrusted data reaches the CEL eventtype column through the CELGenUserEvent dialplan application. An attacker who can influence that dialplan input can read or change the database behind the CEL logging.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `asterisk -V` to read the installed version and compare it with the fixed releases.
- Check `cel.conf` and `modules.conf` for `cel_pgsql` or `cel_tds` being loaded and configured.
- Search the dialplan for `CELGenUserEvent` and check whether its arguments come from caller or external input.

## Fix

- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`, or Certified Asterisk to `20.7-cert11` or `22.8-cert3`.
- Until upgraded, stop using `CELGenUserEvent` with untrusted values or disable the cel_pgsql and cel_tds backends.

## Timeline

- 2026-10-27T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57190

## From the sources

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_