CVE-2026-26263: GLPI Search Engine SQLi Vulnerability

CVE-2026-26263 Overview

CVE-2026-26263 is a critical SQL Injection vulnerability affecting GLPI, a widely-used free asset and IT management software package. The vulnerability exists as an unauthenticated time-based blind SQL injection in GLPI's Search engine, present in versions from 11.0.0 to before 11.0.6. This flaw allows remote attackers to execute arbitrary SQL queries against the underlying database without requiring authentication, potentially leading to complete database compromise, data exfiltration, and unauthorized system access.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the GLPI database, modify records, or potentially gain control over the underlying server infrastructure.

Affected Products

• GLPI versions 11.0.0 through 11.0.5
• glpi-project GLPI (all installations running vulnerable versions)

Discovery Timeline

• 2026-04-06 - CVE-2026-26263 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-26263

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The flaw resides in GLPI's Search engine component, where user-supplied input is improperly sanitized before being incorporated into SQL queries.

The time-based blind SQL injection technique allows attackers to infer database information by observing response time delays. When a malicious SQL query causes the database to pause execution (using functions like SLEEP() in MySQL), the attacker can deduce whether conditions are true or false based on how long the server takes to respond. This method is particularly dangerous because it can extract sensitive data character by character, even when the application does not directly return database error messages or query results.

The attack can be executed over the network without any authentication, significantly increasing the risk surface for organizations running vulnerable GLPI instances exposed to the internet or untrusted networks.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the GLPI Search engine component. User-controlled parameters are concatenated or interpolated directly into SQL queries without proper parameterization or escaping, allowing attackers to inject malicious SQL syntax that alters the intended query logic.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests targeting the GLPI Search engine endpoint, embedding time-based SQL injection payloads within search parameters. The time-based blind technique works by injecting conditional SQL statements that cause measurable delays when specific conditions evaluate to true.

For example, an attacker could systematically extract database credentials, user information, or other sensitive data stored within GLPI's database by iterating through possible characters and observing response timing patterns. This vulnerability is particularly severe in environments where GLPI manages critical IT assets, tickets, and user credentials.

Detection Methods for CVE-2026-26263

Indicators of Compromise

• Unusually slow response times from the GLPI Search engine endpoint that may indicate time-based SQL injection attempts
• High volume of requests to search-related endpoints with malformed or suspicious parameter values
• Database logs showing unusual SLEEP(), BENCHMARK(), or WAITFOR function calls
• Access logs containing SQL syntax characters (', ", --, ;, UNION, SELECT) in URL parameters

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting GLPI
• Monitor application logs for repeated search requests with anomalous timing patterns
• Implement database query logging to identify queries containing injection indicators
• Use intrusion detection systems (IDS) with signatures for time-based SQL injection attacks

Monitoring Recommendations

• Enable verbose logging on GLPI's web server and database to capture suspicious query patterns
• Configure alerting for requests to the Search engine with response times significantly exceeding normal baselines
• Regularly audit database access logs for unauthorized data extraction attempts
• Monitor network traffic for high-frequency requests to search endpoints that may indicate automated exploitation

How to Mitigate CVE-2026-26263

Immediate Actions Required

• Upgrade GLPI to version 11.0.6 or later immediately to remediate this vulnerability
• If immediate patching is not possible, restrict network access to GLPI instances to trusted networks only
• Implement Web Application Firewall (WAF) rules to filter SQL injection attempts targeting the Search engine
• Review database logs for evidence of prior exploitation and consider credential rotation if compromise is suspected

Patch Information

The GLPI development team has addressed this vulnerability in version 11.0.6. Organizations should upgrade to this version or later as the primary remediation action. For detailed patch information and security guidance, refer to the GLPI Security Advisory on GitHub.

Workarounds

• Restrict access to GLPI instances using network-level controls such as firewalls or VPNs to limit exposure to untrusted networks
• Disable or restrict access to the Search engine functionality if not critically required until patching is complete
• Deploy a reverse proxy with SQL injection filtering capabilities in front of the GLPI application
• Implement database connection user permissions with least-privilege principles to minimize potential damage from SQL injection

# Example: Restrict GLPI access using iptables (Linux)
# Allow access only from trusted internal network
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP