CVE-2026-35152: Apache Fineract SQL Injection Vulnerability

CVE-2026-35152 Overview

CVE-2026-35152 is a SQL Injection vulnerability [CWE-89] in Apache Fineract's Report Execution API, specifically the runreports endpoint. Versions up to and including 1.14.0 incorporate report parameter values into the generated SQL query without sufficient validation. An authenticated user with permission to run reports can inject arbitrary SQL through crafted parameter values. The flaw allows unauthorized access to data beyond what the report was designed to expose.

Critical Impact
Authenticated attackers with report-execution privileges can exfiltrate sensitive financial data from Apache Fineract deployments by injecting SQL through report parameters, impacting confidentiality, integrity, and availability.

Affected Products

Apache Fineract versions up to and including 1.14.0
Deployments exposing the runreports endpoint of the Report Execution API
Any Fineract instance where authenticated users hold report execution permissions

Discovery Timeline

2026-07-15 - CVE CVE-2026-35152 published to the National Vulnerability Database (NVD)
2026-07-15 - Vulnerability discussed on the Openwall oss-security mailing list
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-35152

Vulnerability Analysis

Apache Fineract is an open-source core banking platform used by financial institutions to deliver services to underbanked populations. The runreports endpoint accepts user-supplied parameter values that the application substitutes into a SQL query string before execution. Because these values are concatenated rather than bound as parameters, the query engine cannot distinguish user data from SQL syntax.

An authenticated user with the report execution permission can supply a specially crafted parameter value containing SQL fragments. The injected fragments alter the query's structure, enabling union-based extraction, boolean-based inference, or arbitrary table access. Since Fineract stores customer records, loan portfolios, and transaction ledgers, successful exploitation exposes regulated financial data.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. Report parameter values pass into query construction without being parameterized or escaped. The permission model gates who can invoke reports but does not constrain the content of the parameters, so any authenticated report user becomes a potential SQL injection vector.

Attack Vector

Exploitation requires network access to the Fineract HTTP API and valid credentials with report execution rights. An attacker sends an authenticated request to the runreports endpoint and embeds SQL syntax within a report parameter. The application incorporates the payload into the executed query, returning data or performing operations selected by the attacker. No user interaction is required beyond attacker-issued API requests.

For technical details on the fix, refer to the Apache Fineract GitHub Pull Request #5980 and the Apache Mailing List Thread.

Detection Methods for CVE-2026-35152

Indicators of Compromise

Requests to the /runreports/* endpoint containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; inside parameter values
Unusual report execution volumes from a single authenticated account
Database query logs showing malformed or unexpectedly long SQL statements originating from the Fineract application user
Access patterns to tables that are outside the scope of the invoked report definition

Detection Strategies

Enable SQL statement logging on the backing database and alert on statements originating from the Fineract service that touch sensitive tables not referenced by the invoked report
Deploy a web application firewall (WAF) rule set that inspects runreports request bodies and query parameters for SQL injection signatures
Correlate authentication logs with report execution audit trails to identify accounts exercising the endpoint at abnormal frequency

Monitoring Recommendations

Baseline normal report parameter values per user role and alert on deviations in length, character set, or content
Forward Fineract application logs and database audit logs to a centralized analytics platform for retrospective hunting
Monitor egress traffic volume from the application tier for signs of bulk data exfiltration following report executions

How to Mitigate CVE-2026-35152

Immediate Actions Required

Upgrade Apache Fineract to a version containing the fix as recommended by the Apache Fineract project
Audit user accounts holding report execution permissions and revoke access for accounts that do not require it
Rotate database credentials used by the Fineract service if compromise is suspected and review recent report execution history for anomalies

Patch Information

The Apache Fineract project has released a fix through Pull Request #5980. Coordination and disclosure details are documented on the Apache mailing lists, including the primary advisory thread and a follow-up discussion thread. Additional context is available in the Openwall OSS Security Discussion.

Workarounds

Restrict access to the /runreports/* endpoint at the reverse proxy or API gateway to a minimal set of trusted users until the patch is applied
Configure the database account used by Fineract with least-privilege permissions so that injected queries cannot reach tables outside the reporting scope
Deploy WAF rules that block SQL metacharacters in report parameter values as a compensating control

bash

# Example NGINX restriction limiting runreports access by source IP
location ~ ^/fineract-provider/api/v1/runreports/ {
    allow 10.0.0.0/24;   # trusted reporting subnet
    deny  all;
    proxy_pass http://fineract_backend;
}