CVE-2026-21856: Tarkov Data Manager SQLi Vulnerability

CVE-2026-21856 Overview

A time-based blind SQL injection vulnerability has been identified in the Tarkov Data Manager, a tool designed to manage Tarkov item data. This vulnerability exists in the webhook edit and scanner API endpoints, allowing authenticated attackers to execute arbitrary SQL queries against the MySQL database. The flaw stems from improper parameterization of SQL queries, enabling attackers with authenticated access to extract, modify, or delete sensitive database information.

Critical Impact

Authenticated attackers can execute arbitrary SQL queries against the MySQL database, potentially leading to data exfiltration, unauthorized data modification, or complete database compromise.

Affected Products

• Tarkov Data Manager (prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8)

Discovery Timeline

• 2026-01-07 - CVE-2026-21856 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21856

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the webhook edit and scanner API endpoints within the Tarkov Data Manager application. The vulnerability is classified as a time-based blind SQL injection, meaning attackers cannot directly observe query results but can infer database information through response timing differences. By crafting malicious input that causes conditional database delays, an attacker can systematically extract sensitive information character by character.

The attack requires network access and authenticated privileges to the application. Once authenticated, the attacker can leverage the improperly sanitized API parameters to inject arbitrary SQL commands into database queries targeting the MySQL backend.

Root Cause

The root cause of this vulnerability lies in improper SQL query parameterization within the webhook update functionality. The original code passed the req.params.id parameter directly to the query string rather than including it in the parameterized values array. This allowed user-controlled input to be interpreted as part of the SQL query structure rather than as a data value, enabling SQL injection attacks.

Attack Vector

The attack is network-based and requires authenticated access to the application. An attacker with valid credentials can target the webhook edit endpoint (/webhooks/:id) or scanner API endpoints by manipulating the id parameter or other input fields. Since this is a time-based blind injection, the attacker would typically use automated tools to send carefully crafted payloads containing SQL timing functions (such as SLEEP() in MySQL) to systematically extract database contents.

             updateValues.push(updates[field]);
         }
         if (updateFields.length > 0) {
+            updateValues.push(req.params.id);
             await dbConnection.query(`UPDATE webhooks SET ${updateFields.map(field => {
                 return `${field} = ?`;
-            }).join(', ')} WHERE id=?`, updateValues, req.params.id);
+            }).join(', ')} WHERE id=?`, updateValues);
             webhookApi.refresh();
             response.message = `Updated ${updateFields.join(', ')}`;
             console.log(`Edited webhook ${req.params.id}: ${updateFields.join(', ')}`)

Source: GitHub Commit Record

Detection Methods for CVE-2026-21856

Indicators of Compromise

• Unusually slow database query response times that may indicate time-based SQL injection probing
• Database logs showing malformed or suspicious SQL queries containing timing functions like SLEEP(), BENCHMARK(), or WAITFOR DELAY
• Repeated requests to webhook edit or scanner API endpoints with anomalous parameter values
• Error logs indicating SQL syntax errors from the MySQL database

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect common SQL injection patterns and payloads
• Enable detailed logging on API endpoints to capture and analyze request parameters
• Monitor database query logs for unusual patterns, particularly queries with timing functions or conditional statements
• Deploy application-level intrusion detection to flag requests with SQL metacharacters in URL parameters

Monitoring Recommendations

• Enable MySQL slow query logging to identify queries with abnormal execution times
• Configure alerting for repeated authentication attempts followed by API endpoint access patterns
• Implement real-time monitoring of database connection pools for unusual activity
• Review application access logs regularly for suspicious patterns targeting webhook and scanner endpoints

How to Mitigate CVE-2026-21856

Immediate Actions Required

• Update Tarkov Data Manager to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8 or later immediately
• Review database logs for any signs of exploitation prior to patching
• Audit database access and user accounts for unauthorized changes
• Consider temporarily restricting access to webhook edit and scanner API endpoints until patched

Patch Information

The vulnerability has been patched in commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8. The fix corrects the SQL query parameterization by properly including the id parameter within the parameterized values array rather than passing it as a separate argument. This ensures user input is treated as data rather than executable SQL code. Detailed information is available in the GitHub Security Advisory GHSA-4gcx-ghwc-rc78.

Workarounds

• Implement input validation on API endpoints to reject requests with SQL metacharacters
• Deploy a Web Application Firewall with SQL injection protection rules
• Restrict network access to the application to trusted IP addresses only
• Enable database user permission restrictions to limit potential damage from SQL injection

# Configuration example
# Ensure proper parameterization in database queries
# Before (vulnerable): query(sql, values, req.params.id)
# After (secure): Include all parameters in the values array
# updateValues.push(req.params.id);
# query(sql, updateValues);