CVE-2026-44047: Netatalk MySQL CNID SQL Injection Flaw

CVE-2026-44047 Overview

CVE-2026-44047 is a SQL injection vulnerability in the MySQL Catalog Node ID (CNID) backend of Netatalk versions 3.1.0 through 4.4.2. Netatalk implements the Apple Filing Protocol (AFP) for serving files to macOS clients from Unix-like systems. A remote authenticated attacker can inject SQL statements into queries processed by the MySQL CNID backend. Successful exploitation grants unauthorized access to data, allows modification of database contents, or triggers denial of service against the file server.

Critical Impact
Authenticated attackers can read, modify, or destroy CNID database contents and disrupt AFP file services backed by MySQL.

Affected Products

Netatalk 3.1.0 through 4.4.2
Deployments using the MySQL CNID backend (cnid_mysql)
AFP file servers exposing the MySQL-backed catalog database

Discovery Timeline

2026-05-21 - CVE CVE-2026-44047 published to NVD
2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-44047

Vulnerability Analysis

The flaw resides in the MySQL CNID backend used by Netatalk to map persistent catalog node identifiers to filesystem objects. Netatalk constructs SQL queries that incorporate attacker-influenced input without proper parameterization or escaping. A remote authenticated attacker with access to AFP shares can submit filenames, paths, or metadata that are interpolated directly into SQL statements [CWE-89].

Because the CNID backend executes queries against the underlying MySQL database with the privileges of the Netatalk service account, successful injection compromises confidentiality, integrity, and availability of the catalog database. The change in scope is unchanged, but impact spans data exfiltration, tampering with file identity mappings, and service disruption.

Root Cause

The root cause is the construction of dynamic SQL through string concatenation rather than prepared statements with bound parameters. Input originating from AFP protocol operations reaches SQL execution paths in the MySQL CNID backend without sanitization, enabling injection of arbitrary SQL fragments.

Attack Vector

Exploitation requires network access to the AFP service and valid authenticated credentials. Once authenticated, an attacker performs file operations that propagate crafted strings into CNID backend queries. The Netatalk Security Advisory describes the vulnerable code paths and the conditions required to reach them. See the Netatalk Security Advisory for technical details.

Detection Methods for CVE-2026-44047

Indicators of Compromise

Anomalous SQL statements in MySQL general or audit logs originating from the Netatalk service account
Unexpected modifications to the CNID database tables or rows referencing unusual filesystem paths
AFP session activity from authenticated users containing SQL metacharacters such as single quotes, comment sequences, or UNION keywords in filenames

Detection Strategies

Enable MySQL query logging on the CNID database and alert on statements containing injection patterns such as stacked queries, UNION SELECT, or comment markers
Correlate AFP authentication events with subsequent abnormal database queries from the Netatalk process
Monitor Netatalk error logs for SQL syntax errors, which often indicate probing attempts

Monitoring Recommendations

Forward Netatalk and MySQL logs to a centralized SIEM for retention and correlation
Baseline normal CNID query patterns and alert on deviations in query structure or volume
Track authentication failures and brute-force patterns against AFP services to identify pre-exploitation activity

How to Mitigate CVE-2026-44047

Immediate Actions Required

Upgrade Netatalk to a version released after 4.4.2 that addresses CVE-2026-44047 once available from the maintainers
Restrict AFP service exposure to trusted network segments and require VPN access for remote users
Audit accounts with AFP access and remove unused or shared credentials that increase the authenticated attack surface

Patch Information

Refer to the Netatalk Security Advisory for the fixed version and upgrade instructions. Apply the vendor patch on all affected hosts running Netatalk 3.1.0 through 4.4.2 with the MySQL CNID backend.

Workarounds

Switch the CNID backend from MySQL to an alternative supported backend such as cnid_dbd until patches are applied
Apply least-privilege configuration to the MySQL account used by Netatalk, limiting it to the specific CNID database and required operations
Enforce strong authentication and disable guest or anonymous AFP access to reduce the pool of authenticated attackers

bash

# Example: switch CNID backend in afp.conf
[Global]
  cnid server = localhost:4700
  default cnid scheme = dbd

[Volume]
  path = /srv/share
  cnid scheme = dbd