CVE-2026-105412: Tuleap Enterprise Edition SQL Injection

CVE-2026-105412 Overview

CVE-2026-105412 is a SQL Injection vulnerability [CWE-89] affecting Tuleap Enterprise Edition 17.5. An authenticated attacker can inject SQL statements that grant read access to the underlying Tuleap database. The flaw stems from improper neutralization of user-supplied input before it reaches SQL queries. Exploitation requires network access and low privileges, but no user interaction.

Critical Impact
An authenticated attacker can read sensitive data from the Tuleap database, including project artifacts, user records, and configuration values stored by Tuleap Enterprise Edition 17.5.

Affected Products

Tuleap Enterprise Edition 17.5

Discovery Timeline

2026-10-12 - CVE-2026-105412 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-105412

Vulnerability Analysis

The vulnerability is a server-side SQL Injection in Tuleap Enterprise Edition 17.5. Attacker-controlled input is concatenated into a SQL query without proper parameterization or escaping. A low-privileged authenticated user can send crafted requests over the network to manipulate query logic. Successful exploitation yields read access to database contents, exposing records that the attacker is not authorized to view.

The impact is confined to confidentiality and limited availability. Integrity is not affected, which suggests the injectable sink executes SELECT-class statements rather than data-modifying operations. Attackers can still extract credentials, tokens, or project metadata that enable follow-on attacks against Tuleap users and connected systems.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. Input received through an authenticated Tuleap request path reaches a database query without prepared statements or sufficient allowlist validation. This allows injected SQL fragments to alter query semantics at execution time.

Attack Vector

The attack vector is network-based and requires valid Tuleap credentials with low privileges. An attacker authenticates to Tuleap Enterprise Edition 17.5 and submits a crafted parameter to the vulnerable endpoint. The injected payload executes within the application's database session, returning rows the attacker should not be able to read. Refer to the 3DS Security Advisory CVE-2026-105412 for vendor-provided technical specifics.

Detection Methods for CVE-2026-105412

Indicators of Compromise

Authenticated HTTP requests to Tuleap containing SQL metacharacters such as ', --, UNION SELECT, or information_schema references in query parameters or POST bodies.
Database query logs showing anomalous SELECT statements against sensitive tables issued from the Tuleap application user.
Spikes in request volume or response size from a single authenticated Tuleap account targeting a specific endpoint.

Detection Strategies

Enable Tuleap and web server access logging, then review authenticated requests for SQL syntax patterns and encoded variants.
Deploy a web application firewall rule set tuned for SQL injection targeting the Tuleap application paths.
Correlate authentication events with database query telemetry to flag accounts issuing unusual query patterns.

Monitoring Recommendations

Forward Tuleap web, application, and MySQL query logs to a centralized SIEM for retention and correlation.
Alert on authenticated sessions that generate database errors referencing SQL syntax or type mismatches.
Monitor outbound data volumes from the Tuleap database host to detect bulk extraction.

How to Mitigate CVE-2026-105412

Immediate Actions Required

Upgrade Tuleap Enterprise Edition 17.5 to the fixed release identified in the 3DS Security Advisory CVE-2026-105412.
Audit Tuleap user accounts and revoke access for inactive, shared, or unnecessary low-privilege accounts.
Rotate credentials, API tokens, and secrets stored in Tuleap if exposure is suspected.

Patch Information

Dassault Systèmes publishes patch and version guidance in the 3DS Security Advisory CVE-2026-105412. Apply the vendor-recommended Tuleap Enterprise Edition update that addresses the SQL Injection in the 17.x branch.

Workarounds

Restrict network access to Tuleap Enterprise Edition 17.5 to trusted networks and authenticated users via VPN or reverse proxy allowlists.
Deploy a web application firewall with SQL injection signatures in front of Tuleap until the patch is applied.
Reduce database account privileges used by Tuleap to the minimum required, limiting the data readable through any successful injection.

bash

# Example WAF rule concept (ModSecurity-style) to block common SQLi tokens
# Replace with vendor-specific syntax and tune for your environment
SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|sleep\(|benchmark\(|--\s)" \
  "id:1052026,phase:2,deny,status:403,log,msg:'Possible SQLi targeting Tuleap CVE-2026-105412'"