CVE-2026-42097: Sparx Pro Cloud Server SQLi Vulnerability

CVE-2026-42097 Overview

CVE-2026-42097 is an authentication bypass vulnerability in Sparx Pro Cloud Server. The server enforces authentication based on the requested URL, specifically inspecting the model query parameter. Attackers can omit the model query parameter from the URL and instead place the model name inside the binary blob of a POST request. This routing inconsistency permits unauthenticated SQL query execution against the backend database. The flaw is classified under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact

Unauthenticated remote attackers can execute SQL queries against Sparx Pro Cloud Server, exposing modeling data and supporting credentials stored in the database.

Affected Products

• Sparx Pro Cloud Server version 6.1 (build 167) and below (confirmed)
• Earlier versions of Sparx Pro Cloud Server (untested, potentially vulnerable)
• Deployments exposing the Pro Cloud Server HTTP interface to untrusted networks

Discovery Timeline

• 2026-05-19 - CVE-2026-42097 published to the National Vulnerability Database
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-42097

Vulnerability Analysis

Sparx Pro Cloud Server exposes an HTTP interface that processes requests containing a serialized binary blob in the POST body. The authentication layer inspects the model parameter in the URL query string to determine whether a request requires credentials. When the parameter is present, the server enforces authentication against the corresponding model. When the parameter is absent from the URL, the authentication decision diverges from the request processing logic. The request handler still extracts the model name from the binary blob in the POST body and proceeds to execute SQL queries against that model. This split between authentication enforcement and request routing produces an authorization gap that grants attackers direct query access.

Root Cause

The root cause is inconsistent identifier resolution between the authentication middleware and the SQL execution path. The authentication layer relies solely on the URL query string, while the SQL execution layer accepts the same identifier from the request body. Both code paths trust the user-controlled value, but only one is bound to authentication checks.

Attack Vector

The vulnerability is exploitable over the network without credentials or user interaction. An attacker crafts a POST request to the Sparx Pro Cloud Server endpoint, omitting model from the query string while embedding the target model name and the SQL payload within the binary blob body. The server bypasses authentication, parses the blob, and executes the supplied SQL against the referenced model. No exploitation in the wild has been confirmed, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Sploit Tech analysis of Sparx Enterprise Architect PCS and the CERT Poland CVE Analysis for additional technical detail.

No verified proof-of-concept code has been released. Refer to the Efigo blog for further technical context.

Detection Methods for CVE-2026-42097

Indicators of Compromise

• POST requests to Sparx Pro Cloud Server endpoints that lack the model query parameter but include a non-empty binary body
• Unexpected SQL query patterns or schema enumeration originating from the Pro Cloud Server service account
• Anonymous or unauthenticated sessions executing database operations that normally require an authenticated model context

Detection Strategies

• Inspect web server and reverse proxy logs for POST requests to Pro Cloud Server URLs missing the model query parameter
• Correlate Pro Cloud Server access logs with backend database query logs to identify unauthenticated callers triggering SQL execution
• Apply signatures on web application firewalls to flag requests whose body contains model identifiers when the query string does not

Monitoring Recommendations

• Enable verbose request logging on the Pro Cloud Server front-end, including full query strings and request sizes
• Forward Pro Cloud Server and database telemetry to a central analytics platform for correlation and retention
• Alert on bursts of failed or anomalous SQL statements tied to the Pro Cloud Server connection pool

How to Mitigate CVE-2026-42097

Immediate Actions Required

• Restrict network access to Sparx Pro Cloud Server so that only trusted clients can reach the HTTP interface
• Place the server behind an authenticated reverse proxy or VPN until a vendor patch is verified
• Audit Pro Cloud Server and database logs for prior unauthenticated requests matching the attack pattern

Patch Information

The vendor was notified but did not respond with details of the vulnerability or a confirmed vulnerable version range. No fixed version has been published in the NVD record. Monitor the Sparx Systems Pro Cloud Server product page for vendor updates and apply any security release as soon as it becomes available.

Workarounds

• Configure a reverse proxy to reject POST requests to Pro Cloud Server endpoints that omit the model query parameter
• Enforce mutual TLS or network-layer authentication in front of Pro Cloud Server to deny anonymous traffic
• Limit database account privileges used by Pro Cloud Server to reduce the impact of injected SQL

# Example NGINX rule to block POST requests missing the 'model' query parameter
location /pcs/ {
    if ($request_method = POST) {
        if ($arg_model = "") {
            return 403;
        }
    }
    proxy_pass http://procloudserver_backend;
}