CVE-2026-44447: ERPNext SQL Injection Vulnerability

CVE-2026-44447 Overview

CVE-2026-44447 is a SQL injection vulnerability in ERPNext, a free and open source Enterprise Resource Planning (ERP) tool maintained by Frappe. Versions prior to 16.9.0 expose endpoints that fail to properly sanitize user-supplied input. Authenticated attackers can send specially crafted requests to trigger SQL injection and extract sensitive information from the underlying database. The vulnerability is fixed in version 16.9.0. The flaw is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated network attackers can extract sensitive data from ERPNext databases through specially crafted requests targeting vulnerable endpoints, compromising confidentiality, integrity, and availability.

Affected Products

• ERPNext versions prior to 16.9.0
• Frappe ERPNext open source Enterprise Resource Planning platform
• Self-hosted and cloud deployments running affected ERPNext releases

Discovery Timeline

• 2026-05-13 - CVE-2026-44447 published to the National Vulnerability Database (NVD)
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44447

Vulnerability Analysis

The vulnerability resides in multiple ERPNext endpoints that construct SQL statements using untrusted input without sufficient parameterization or escaping. An authenticated user can craft request parameters that break out of the intended query context. The malicious payload then executes as part of the database query, allowing the attacker to read arbitrary table contents.

Because ERPNext stores financial records, customer data, supplier information, and HR records, successful exploitation exposes business-critical data. The CVSS vector indicates low attack complexity and a network-reachable attack surface, requiring only low-privilege authentication. The flaw impacts confidentiality, integrity, and availability of the database tier.

Root Cause

The root cause is improper neutralization of special elements in SQL queries [CWE-89]. Affected endpoints concatenate or interpolate user input directly into SQL statements rather than using parameterized queries or the framework's safe query builders. Input filters fail to reject SQL metacharacters in fields that ultimately reach the database layer.

Attack Vector

The attack vector is network-based and requires authenticated access to ERPNext. An attacker with any valid account, including low-privilege roles, can target the vulnerable endpoints by submitting HTTP requests containing crafted parameter values. The injected SQL executes with the privileges of the ERPNext database user, granting access to all tables that account can read.

Specific technical exploitation details have not been published. Refer to the GitHub Security Advisory GHSA-q65v-fm9p-9vh3 for vendor-supplied technical context.

Detection Methods for CVE-2026-44447

Indicators of Compromise

• HTTP requests to ERPNext endpoints containing SQL metacharacters such as single quotes, UNION SELECT, --, /*, or SLEEP( in parameter values
• Database query logs showing unusually long-running SELECT statements or queries referencing information_schema tables
• Application error responses revealing SQL syntax errors returned to clients
• Unexpected egress traffic from the ERPNext application server following authenticated sessions from low-privilege accounts

Detection Strategies

• Enable verbose application and database query logging on ERPNext and forward logs to a centralized analytics platform for correlation
• Deploy a Web Application Firewall (WAF) with SQL injection signatures tuned for the ERPNext URL patterns
• Hunt for sequential requests from a single session that iterate through parameter mutations, a behavior consistent with automated SQLi tooling
• Compare authenticated user query patterns against historical baselines to identify anomalous data access volumes

Monitoring Recommendations

• Monitor authentication logs for newly created or rarely used accounts that begin issuing unusual API requests
• Alert on database responses containing schema metadata returned to non-administrative ERPNext users
• Track outbound data transfer volumes from the ERPNext application tier to detect bulk extraction
• Audit access to sensitive DocTypes such as User, Customer, and financial records for anomalous read patterns

How to Mitigate CVE-2026-44447

Immediate Actions Required

• Upgrade ERPNext to version 16.9.0 or later as the primary remediation
• Inventory all ERPNext deployments, including development and staging instances, and confirm patch status
• Rotate API keys, session secrets, and database credentials if exploitation is suspected
• Review user accounts and revoke any unnecessary or stale low-privilege access that could be used to reach vulnerable endpoints

Patch Information

The vendor has released a fix in ERPNext version 16.9.0. Administrators should follow the standard Frappe bench upgrade procedure to apply the patched release. Refer to the GitHub Security Advisory GHSA-q65v-fm9p-9vh3 for complete remediation guidance.

Workarounds

• Place ERPNext behind a WAF configured with SQL injection rules until the upgrade is completed
• Restrict network access to ERPNext endpoints using IP allowlists or VPN-only access
• Apply database-tier least privilege so the ERPNext service account cannot read tables beyond what the application requires
• Disable or restrict access to non-essential endpoints and modules for low-privilege roles

# Upgrade ERPNext using Frappe bench
bench update --reset
bench --site <site-name> migrate
bench --site <site-name> version
# Confirm ERPNext reports 16.9.0 or later