CVE-2026-109609: Frappe ERPNext SQL Injection Vulnerability

CVE-2026-109609 Overview

CVE-2026-109609 is a SQL injection vulnerability [CWE-89] in Frappe ERPNext, an open-source enterprise resource planning (ERP) platform. The flaw affects versions prior to 15.119.1 and 16.x versions before 16.32.0. Several endpoints lack proper input validation, allowing authenticated attackers with low privileges to inject SQL statements through crafted requests. Successful exploitation enables extraction of sensitive information from the ERPNext database, including customer records, financial data, and credentials. The vulnerability requires network access and valid user authentication but no user interaction.

Critical Impact
Authenticated attackers can exfiltrate confidential business data from ERPNext deployments by injecting SQL through unvalidated endpoint parameters.

Affected Products

Frappe ERPNext versions prior to 15.119.1
Frappe ERPNext 16.x versions prior to 16.32.0
Self-hosted and cloud-deployed ERPNext instances exposing authenticated endpoints

Discovery Timeline

2026-10-12 - CVE-2026-109609 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109609

Vulnerability Analysis

The vulnerability resides in ERPNext endpoints that accept user-controlled parameters and incorporate them into SQL queries without adequate sanitization or parameterization. An authenticated user with low-privilege access can supply crafted payloads that break out of intended query structure. The database executes the attacker-controlled SQL alongside the legitimate statement, returning data the user would not normally be authorized to retrieve. Because ERPNext stores sensitive business records such as invoices, HR data, customer PII, and API tokens, the impact centers on confidentiality rather than integrity or availability.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. Specific endpoints concatenate request parameters into query strings instead of using parameterized queries or the Frappe ORM's safe query APIs. Missing server-side validation allows metacharacters such as single quotes, comments, and UNION keywords to pass through to the database layer.

Attack Vector

Exploitation requires network access to the ERPNext web application and valid credentials for any low-privilege account. The attacker sends HTTP requests to the vulnerable endpoints with SQL payloads embedded in parameter values. No user interaction and no elevated permissions are required. See the GitHub Security Advisory GHSA-xp5c-86f4-7ppf and the VulnCheck Advisory for SQL Injection for additional technical context.

No verified proof-of-concept code has been published. Public exploitation details are deliberately limited to encourage patching before weaponization.

Detection Methods for CVE-2026-109609

Indicators of Compromise

HTTP request logs containing SQL metacharacters such as ', --, /*, UNION, or SLEEP( in parameter values sent to ERPNext endpoints
Unexpected frappe.db error messages or database syntax errors appearing in application logs
Anomalous query patterns in the MariaDB or PostgreSQL slow-query log originating from the ERPNext application user
Low-privilege user sessions issuing high volumes of requests to data-returning endpoints

Detection Strategies

Deploy a web application firewall (WAF) rule set to flag SQL injection signatures in requests to /api/method/ and related ERPNext routes
Correlate authenticated session identifiers with database query volume to surface accounts exceeding baseline read activity
Enable database query auditing on tables holding financial, customer, and credential data to detect unauthorized SELECT patterns

Monitoring Recommendations

Centralize ERPNext application logs, reverse-proxy access logs, and database audit logs in a SIEM for cross-source correlation
Alert on repeated HTTP 500 responses from the same session, which often indicate injection probing
Track outbound data volume per authenticated user to identify bulk extraction attempts

How to Mitigate CVE-2026-109609

Immediate Actions Required

Upgrade Frappe ERPNext to version 15.119.1 or 16.32.0 or later without delay
Audit all user accounts and revoke unused low-privilege access to reduce the authenticated attack surface
Rotate API keys, secrets, and credentials stored in ERPNext if exploitation is suspected
Review recent access and query logs for signs of SQL injection probing or data exfiltration

Patch Information

Frappe has released fixed versions 15.119.1 and 16.32.0. Upgrade instructions and the complete advisory are published at the GitHub Security Advisory GHSA-xp5c-86f4-7ppf. Administrators running the Frappe Cloud managed service should confirm their site has been migrated to a patched release.

Workarounds

Restrict network access to the ERPNext web interface using VPN or IP allowlists where feasible
Place a WAF in front of the ERPNext application with SQL injection rules enabled
Enforce the principle of least privilege by removing API access from accounts that do not require it
Monitor and rate-limit authenticated requests to data-returning endpoints until the patch is applied

bash

# Upgrade ERPNext using the bench CLI
bench switch-to-branch version-15 erpnext frappe
bench update --reset
bench --site <site-name> migrate
bench restart