CVE-2026-44446: ERPNext SQL Injection Vulnerability

CVE-2026-44446 Overview

CVE-2026-44446 is a SQL injection vulnerability affecting ERPNext, a free and open source Enterprise Resource Planning (ERP) platform built on the Frappe framework. Specific endpoints accept specially crafted requests that pass unsanitized input into database queries. Authenticated attackers can exploit these endpoints to extract sensitive information stored within the ERPNext database. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command and is fixed in versions 15.104.3 and 16.14.0.

Critical Impact

A low-privileged authenticated attacker can extract sensitive data from the ERPNext database over the network, compromising confidentiality, integrity, and availability of business records.

Affected Products

• ERPNext versions prior to 15.104.3
• ERPNext versions prior to 16.14.0 in the 16.x release line
• Deployments running on the Frappe framework that expose the vulnerable endpoints

Discovery Timeline

• 2026-05-13 - CVE CVE-2026-44446 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44446

Vulnerability Analysis

The vulnerability resides in ERPNext endpoints that construct database queries using attacker-controlled input. Because input is not properly neutralized before reaching the SQL layer, an attacker can inject SQL syntax to alter query logic. The published advisory describes the flaw as exploitable through specially crafted requests that lead to extraction of sensitive information. Exploitation requires network access and low-privileged authentication, but no user interaction. Because ERPNext stores HR, financial, CRM, and inventory records, successful exploitation exposes business-critical data.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The affected endpoints concatenate or interpolate request parameters directly into SQL statements rather than using parameterized queries or the framework's safe query builders. The fix in 15.104.3 and 16.14.0 enforces proper sanitization and parameter binding on the previously vulnerable endpoints.

Attack Vector

The attack vector is network-based. An authenticated user sends crafted HTTP requests containing malicious SQL fragments to the vulnerable endpoints. The injected SQL is executed against the backend database, allowing the attacker to read records outside their authorization scope, including credentials, financial data, and personally identifiable information. Refer to the GitHub Security Advisory GHSA-6fm9-g88m-hxr7 for technical details. No public proof-of-concept code has been released at the time of disclosure.

Detection Methods for CVE-2026-44446

Indicators of Compromise

• HTTP requests to ERPNext API endpoints containing SQL metacharacters such as ', --, UNION SELECT, or OR 1=1 in parameter values
• Unusual database query patterns or long-running queries originating from the ERPNext application user
• Authenticated sessions accessing endpoints they do not normally use, followed by large response payloads

Detection Strategies

• Enable verbose logging on the Frappe/ERPNext application and the underlying MariaDB or PostgreSQL server to capture suspicious query syntax
• Deploy a web application firewall (WAF) with SQL injection signatures in front of the ERPNext web tier
• Correlate authentication events with API access patterns to identify low-privileged accounts performing atypical data retrieval

Monitoring Recommendations

• Monitor outbound traffic from the ERPNext server for unexpected bulk data transfers indicating exfiltration
• Alert on SQL errors returned by the application, which often accompany injection probing
• Review audit logs for changes to user roles, permissions, or stored credentials following suspicious request activity

How to Mitigate CVE-2026-44446

Immediate Actions Required

• Upgrade ERPNext to version 15.104.3 (15.x line) or 16.14.0 (16.x line) without delay
• Audit all ERPNext user accounts and revoke or rotate credentials for accounts that may have been exposed
• Review database access logs for the period preceding the patch to identify potential exploitation

Patch Information

The vulnerability is fixed in ERPNext 15.104.3 and 16.14.0. Patches and full remediation details are published in the GitHub Security Advisory GHSA-6fm9-g88m-hxr7. Self-hosted operators should apply the upgrade through standard bench workflows. Frappe Cloud tenants receive the patch through managed updates.

Workarounds

• Restrict network access to the ERPNext instance to trusted users and VPN-connected sessions until patching is complete
• Place a WAF in front of ERPNext with SQL injection rules enabled to block crafted payloads targeting vulnerable endpoints
• Apply the principle of least privilege to ERPNext role profiles to reduce the data accessible to any single compromised account

# Upgrade ERPNext using bench (self-hosted deployments)
bench switch-to-branch version-15 erpnext --upgrade
bench update --reset
bench --site <site-name> migrate
bench restart