CVE-2026-51946: GoAdmin SQL Injection Vulnerability

CVE-2026-51946 Overview

CVE-2026-51946 is a SQL Injection vulnerability in GoAdminGroup GoAdmin, an open-source data management platform written in Go. The flaw affects the last released version, v1.2.26, and exists in the __sort_type URL parameter across all /admin/info/{table} endpoints. A remote attacker can inject arbitrary SQL through this parameter to execute database queries and obtain sensitive information. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated network-based SQL injection allowing attackers to read arbitrary data from the underlying database and potentially execute additional code paths through the administrative interface.

Affected Products

GoAdminGroup GoAdmin v1.2.26 (last release at time of disclosure)
Prior GoAdmin releases exposing /admin/info/{table} endpoints
Applications built on the GoAdmin framework using default routing

Discovery Timeline

2026-07-01 - CVE-2026-51946 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-51946

Vulnerability Analysis

The vulnerability resides in how GoAdmin processes the __sort_type query parameter on table listing endpoints under /admin/info/{table}. GoAdmin uses this parameter to determine sort direction when rendering administrative data views. Instead of validating the value against an allow-list such as asc or desc, the framework concatenates it into the generated SQL query. This allows attackers to break out of the intended clause and append arbitrary SQL statements. The issue reflects a common pattern in administrative frameworks where sort and order parameters are treated as identifiers rather than user input.

Root Cause

The root cause is improper neutralization of user-supplied input passed to the SQL query builder. The __sort_type parameter is embedded directly into the ORDER BY clause without parameterization or strict validation. Because Go's database/sql package cannot parameterize identifiers or SQL keywords, developers must explicitly validate these values. GoAdmin's handler for /admin/info/{table} omits this validation step.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to any /admin/info/{table} endpoint on an exposed GoAdmin instance. The attacker supplies a crafted __sort_type parameter containing SQL syntax such as boolean-based, time-based, or UNION-based payloads. The database processes the injected fragment, returning data in the response or through inference channels. Successful exploitation requires network access to the administrative interface but no user interaction or prior authentication. Details of the discovery methodology are documented on the SilentGrid blog covering AI-assisted penetration testing.

See the GoAdmin GitHub repository for source code and remediation status.

Detection Methods for CVE-2026-51946

Indicators of Compromise

HTTP requests to /admin/info/* endpoints containing SQL syntax such as UNION, SLEEP(, --, or /* inside the __sort_type parameter.
Web server logs showing unusually long response times on GoAdmin endpoints, consistent with time-based blind SQL injection.
Database error messages referencing malformed ORDER BY clauses in application logs.

Detection Strategies

Deploy WAF rules that inspect the __sort_type query parameter and reject values outside asc and desc.
Enable SQL query logging on the backend database and alert on ORDER BY clauses containing suspicious tokens or subqueries.
Correlate authentication events with /admin/info/{table} request patterns to identify unauthenticated access attempts.

Monitoring Recommendations

Baseline normal traffic to GoAdmin administrative routes and alert on volume spikes from single source IPs.
Monitor for repeated 500-series HTTP responses from GoAdmin endpoints, which often indicate injection probing.
Track outbound database connections from the GoAdmin process for anomalous query volume or unusual table access.

How to Mitigate CVE-2026-51946

Immediate Actions Required

Restrict network access to GoAdmin administrative endpoints using firewall rules, VPN, or IP allow-listing.
Deploy a WAF signature that blocks non-alphabetic values in the __sort_type parameter.
Audit database accounts used by GoAdmin and enforce least-privilege permissions to limit injection impact.

Patch Information

At the time of NVD publication on 2026-07-01, the last released GoAdmin version v1.2.26 remains affected. Monitor the GoAdmin GitHub repository for an official patched release and upgrade when available. Until a fix is published, apply the workarounds below.

Workarounds

Add a reverse proxy rule that validates __sort_type against a strict allow-list of asc or desc before forwarding requests.
Patch the GoAdmin source locally to validate sort parameters inside the /admin/info/{table} handler prior to query construction.
Disable or remove exposed /admin/info/{table} routes that are not required for production operations.

bash

# Example nginx rule to reject invalid __sort_type values
location /admin/info/ {
    if ($arg___sort_type !~* "^(asc|desc)?$") {
        return 400;
    }
    proxy_pass http://goadmin_backend;
}