CVE-2026-33643: SchemaHero SQL Injection Vulnerability

CVE-2026-33643 Overview

CVE-2026-33643 is a SQL Injection vulnerability in SchemaHero 0.23.0, a Kubernetes-native database schema migration tool. The flaw exists in the mysqlColumnAsInsert function within plugins/mysql/lib/column.go and is reachable through the column parameter. An authenticated attacker with low privileges can submit a crafted column value that is concatenated into a MySQL statement without proper sanitization, manipulating the resulting query. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Successful exploitation allows attackers to alter MySQL queries generated by SchemaHero, potentially exposing or modifying schema and data managed by the controller and impacting cluster components outside the vulnerable scope.

Affected Products

SchemaHero 0.23.0
SchemaHero MySQL plugin (plugins/mysql/lib/column.go)
Kubernetes deployments using SchemaHero for MySQL schema management

Discovery Timeline

2026-03-30 - CVE-2026-33643 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-33643

Vulnerability Analysis

SchemaHero generates MySQL Data Definition Language (DDL) statements based on declarative Kubernetes custom resources. The mysqlColumnAsInsert function in plugins/mysql/lib/column.go builds an INSERT-style fragment that contributes to schema migration statements. The column parameter, supplied through SchemaHero's schema specification, is interpolated directly into the SQL string. Because the routine does not parameterize the value or escape MySQL metacharacters, an attacker controlling the column input can break out of the intended literal and append arbitrary SQL.

The scope change reflected in the CVSS vector indicates that exploitation impacts resources beyond the vulnerable component. A SchemaHero controller typically runs with credentials granting broad rights against the target MySQL instance, so injected statements execute under those privileges.

Root Cause

The root cause is unsanitized string concatenation when constructing MySQL statements. The mysqlColumnAsInsert function trusts the column parameter as a safe identifier or value and inlines it into the query template. No prepared statement, allow-list validation, or mysql_real_escape_string-equivalent routine is applied before the SQL is sent to the database engine.

Attack Vector

An attacker who can create or modify SchemaHero Table or Migration custom resources, or otherwise influence the column input passed to the controller, supplies a malicious value containing SQL metacharacters. When SchemaHero renders and executes the migration, the injected payload runs against MySQL. Depending on the controller's grants, the attacker can read, modify, or delete data, alter schema objects, or pivot to other databases on the same server. Refer to the published proof-of-concept gist and the SchemaHero SQL injection write-up for technical details.

Detection Methods for CVE-2026-33643

Indicators of Compromise

Unexpected MySQL statements in SchemaHero controller logs containing inline comments (--, #), stacked queries, or UNION SELECT patterns.
SchemaHero Table or Migration custom resources with column names containing quotes, semicolons, or SQL keywords.
MySQL audit log entries showing DDL or DML executed by the SchemaHero service account outside scheduled migration windows.

Detection Strategies

Inspect Kubernetes audit logs for create and update events on SchemaHero custom resources where field values contain SQL metacharacters.
Compare rendered migration SQL emitted by the SchemaHero controller against the declarative schema specification to identify divergence.
Enable MySQL general query log or audit plugin and alert on statements from the SchemaHero account that do not match expected CREATE, ALTER, or DROP templates.

Monitoring Recommendations

Forward SchemaHero controller logs and MySQL audit logs to a centralized analytics platform for correlation against Kubernetes API activity.
Baseline normal migration patterns and alert on anomalous query length, multi-statement execution, or use of information_schema by the controller.
Monitor RBAC changes that grant create, update, or patch rights on schemas.schemahero.io and migrations.schemahero.io resources.

How to Mitigate CVE-2026-33643

Immediate Actions Required

Restrict Kubernetes RBAC so only trusted service accounts can create or modify SchemaHero Table, Schema, and Migration custom resources.
Reduce the privileges of the MySQL account used by SchemaHero to the minimum required for schema operations on specific databases.
Review existing SchemaHero custom resources for column names containing SQL metacharacters and remove or remediate any suspicious entries.
Audit MySQL servers managed by SchemaHero for unauthorized schema or data changes since the controller was deployed.

Patch Information

At the time of NVD publication, the affected version is SchemaHero 0.23.0. Monitor the SchemaHero project repository for an updated release that parameterizes or sanitizes the column parameter in plugins/mysql/lib/column.go. Upgrade to a fixed version as soon as it becomes available.

Workarounds

Disable the MySQL plugin or pause SchemaHero migrations until a patched release is deployed if MySQL targets are not strictly required.
Enforce admission control policies (for example, Kyverno or OPA Gatekeeper) that reject SchemaHero resources containing characters such as ', ", ;, --, or /* in column names.
Network-segment the MySQL instance so the SchemaHero controller is the only client able to reach it, limiting blast radius from injected statements.

bash

# Example Kyverno policy fragment rejecting suspicious column names
# in SchemaHero Table resources
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: schemahero-block-sql-metachars
spec:
  validationFailureAction: Enforce
  rules:
    - name: reject-sql-metacharacters-in-columns
      match:
        any:
          - resources:
              kinds:
                - schemas.schemahero.io/Table
      validate:
        message: "Column names must not contain SQL metacharacters."
        pattern:
          spec:
            schema:
              mysql:
                columns:
                  - name: "!*[';\"\\-\\-/*]*"