CVE-2026-41478: Saltcorn SQL Injection Vulnerability

CVE-2026-41478 Overview

CVE-2026-41478 is a critical SQL injection vulnerability affecting Saltcorn, an extensible, open source, no-code database application builder. The vulnerability exists in Saltcorn's mobile-sync routes and allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. Successful exploitation can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend database system in use.

Critical Impact
Authenticated attackers with minimal privileges can achieve full database compromise, extracting sensitive credentials and configuration data, with potential for complete data destruction.

Affected Products

Saltcorn versions prior to 1.4.6
Saltcorn versions prior to 1.5.6
Saltcorn 1.6.0-alpha0 through 1.6.0-beta4 (fixed in 1.6.0-beta.5)

Discovery Timeline

April 24, 2026 - CVE-2026-41478 published to NVD
April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41478

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) resides in the mobile-sync routes of Saltcorn, which handle data synchronization between the mobile application and the backend database. The vulnerability allows authenticated users with minimal privileges—specifically, those with read access to at least one table—to inject malicious SQL statements through sync parameters.

The impact is severe: attackers can exfiltrate the entire database contents, including sensitive information such as administrator password hashes and application configuration secrets. Depending on the database backend and its configuration, attackers may also be able to modify or delete data, potentially causing complete data loss or persistent backdoor installation.

Root Cause

The root cause is improper input validation and sanitization of user-supplied parameters in the mobile-sync routes. The application fails to properly parameterize queries or escape user input before incorporating it into SQL statements, allowing attackers to break out of the intended query context and execute arbitrary SQL commands.

Attack Vector

The attack is network-based and requires authentication with low privileges. An attacker needs only read access to at least one table in the Saltcorn application to exploit this vulnerability. The attacker crafts malicious sync parameters containing SQL injection payloads, which are then executed by the database backend with the privileges of the application's database user.

The vulnerability is particularly dangerous because it requires no user interaction and has a changed scope impact—meaning exploitation of the vulnerable component can affect resources beyond its security scope, potentially compromising the entire database server.

The mobile-sync routes accept parameters that are directly incorporated into SQL queries without proper sanitization. An attacker can craft malicious input containing SQL injection payloads such as UNION SELECT statements to extract data from other tables, or destructive statements like DROP TABLE commands depending on database permissions. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-41478

Indicators of Compromise

Unusual database queries in application logs containing SQL keywords like UNION, SELECT, DROP, or DELETE in sync parameters
Unexpected database access patterns or queries against system tables (e.g., information_schema, pg_catalog)
Authentication anomalies or access to sensitive tables by low-privilege users
Large data transfers from the database during sync operations

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in mobile-sync route requests
Enable database query logging and alert on queries containing suspicious SQL keywords or comment sequences (--, /**/)
Monitor for unusual data access patterns, particularly queries accessing system tables or multiple unrelated tables
Deploy intrusion detection systems (IDS) with SQL injection signature detection capabilities

Monitoring Recommendations

Enable detailed logging on Saltcorn's mobile-sync endpoints to capture all incoming parameters
Configure database audit logging to track all queries executed by the application user
Set up alerts for failed or anomalous authentication attempts followed by sync requests
Monitor network traffic for unusually large responses from sync endpoints that could indicate data exfiltration

How to Mitigate CVE-2026-41478

Immediate Actions Required

Upgrade Saltcorn immediately to version 1.4.6, 1.5.6, or 1.6.0-beta.5 or later
If immediate patching is not possible, disable or restrict access to mobile-sync functionality
Review database access logs for signs of past exploitation
Rotate all sensitive credentials including admin passwords and configuration secrets as a precaution
Implement network-level access controls to limit who can reach the mobile-sync endpoints

Patch Information

The Saltcorn development team has released security patches addressing this vulnerability. Organizations should upgrade to one of the following fixed versions based on their current release track:

Version 1.4.6 for users on the 1.4.x branch
Version 1.5.6 for users on the 1.5.x branch
Version 1.6.0-beta.5 for users on the 1.6.x beta branch

For complete patch details and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

Disable mobile synchronization features entirely until patching is complete
Implement strict WAF rules to filter SQL injection patterns on mobile-sync endpoints
Restrict network access to mobile-sync routes using firewall rules or reverse proxy configuration
Apply principle of least privilege to the database user account used by Saltcorn to limit potential damage

bash

# Example: Restrict access to mobile-sync routes using nginx
# Add to your nginx server configuration
location /mobile-sync {
    # Temporarily deny all access until patched
    deny all;
    # Or restrict to specific IP ranges
    # allow 10.0.0.0/8;
    # deny all;
}