CVE-2026-53448 Overview
CVE-2026-53448 is a SQL injection vulnerability in Coturn, a widely deployed open source implementation of TURN and STUN servers. The flaw affects all versions prior to 4.12.0. The HTTPS admin panel passes HTTP query parameters directly into SQL queries using snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations. An authenticated administrator can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control.
Critical Impact
Authenticated attackers can achieve full database control and potentially OS-level command execution via PostgreSQL COPY TO PROGRAM.
Affected Products
- Coturn versions prior to 4.12.0
- Deployments using the HTTPS admin panel with SQL backends (PostgreSQL, MySQL, SQLite)
- Any Coturn instance exposing delete-user, delete-secret, or delete-IP admin operations
Discovery Timeline
- 2026-07-10 - CVE-2026-53448 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-53448
Vulnerability Analysis
The vulnerability resides in src/apps/relay/turn_admin_server.c, which handles administrative HTTP requests. The admin panel constructs SQL statements by interpolating user-supplied query parameters directly into query strings via snprintf. Because the is_secure_string character filter is only applied to the STUN protocol code path, admin panel operations receive raw attacker-controlled input. This corresponds to [CWE-89] SQL Injection.
An authenticated administrator submitting crafted values in the du (delete-user), ds (delete-secret), or dip (delete-IP) parameters can terminate the intended SQL statement and append arbitrary queries. On PostgreSQL backends, an attacker can escalate database access to operating system command execution using COPY TO PROGRAM, which invokes a shell command from within a SQL statement.
Root Cause
The root cause is missing input validation on admin panel parameters. The is_secure_string function, which rejects characters unsafe for SQL contexts, was applied only to STUN-related realm and username handling. Admin routes for user, secret, and IP list deletion built queries without invoking this filter, permitting quotes, semicolons, and SQL keywords to reach the database driver unchanged.
Attack Vector
Exploitation requires authenticated access to the HTTPS admin panel. An attacker sends HTTP requests containing SQL metacharacters in the du, ds, or dip parameters. The server interpolates the payload into a deletion query, allowing UNION-based extraction, arbitrary INSERT/UPDATE/DELETE, or PostgreSQL COPY ... TO PROGRAM for command execution as the database user.
r = current_realm();
}
- if (current_realm()[0] && strcmp(current_realm(), r)) {
+ if (check_ip_list_range(ip) < 0) {
+ TURN_LOG_FUNC(TURN_LOG_LEVEL_ERROR, "Wrong address range format: %s\n", ip);
+ } else if (current_realm()[0] && strcmp(current_realm(), r)) {
// forbidden
} else if (strcmp(kind, "allowed") != 0 && strcmp(kind, "denied") != 0) {
// forbidden
+ } else if (r[0] && !is_secure_string((const uint8_t *)r, 1)) {
+ // forbidden: realm contains invalid characters
} else {
uint8_t realm[STUN_MAX_REALM_SIZE + 1] = "\0";
Source: Coturn commit b84dbab. The patch adds IP range format validation and enforces is_secure_string on the realm parameter before values are passed into SQL statements.
Detection Methods for CVE-2026-53448
Indicators of Compromise
- HTTP requests to the Coturn admin panel containing SQL metacharacters (', ;, --, UNION, COPY) within the du, ds, or dip query parameters
- Unexpected PostgreSQL COPY TO PROGRAM statements originating from the Coturn database user
- Child processes spawned by the PostgreSQL server account shortly after admin panel access
- Unusual outbound connections or file writes from the database host following admin authentication events
Detection Strategies
- Inspect Coturn HTTPS admin access logs for delete operations carrying non-alphanumeric payloads in du, ds, and dip
- Enable and audit database query logs to identify statements deviating from the expected single-row DELETE pattern
- Correlate admin panel authentication events with subsequent database privilege changes or schema modifications
Monitoring Recommendations
- Restrict network access to the Coturn admin listener and monitor all connections at the perimeter
- Alert on database process trees that include shell interpreters such as sh, bash, or cmd.exe
- Track Coturn version inventory to confirm all instances have been upgraded to 4.12.0 or later
How to Mitigate CVE-2026-53448
Immediate Actions Required
- Upgrade Coturn to version 4.12.0, which contains the official fix
- Rotate all admin panel credentials and database passwords following the upgrade
- Audit the Coturn database for unauthorized users, secrets, or IP list entries
- Review PostgreSQL logs for any COPY TO PROGRAM activity attributable to the Coturn account
Patch Information
The fix is available in Coturn 4.12.0. The patch commit b84dbab1d1aa6e2bf0211a1cdbb250d6de2a0d09 adds is_secure_string validation and IP range format checks to admin panel handlers. Refer to GHSA-v8hj-2xx7-xmp5 for the full advisory and pull request 1924 for the code review.
Workarounds
- Disable the HTTPS admin panel by removing web-admin and related directives from turnserver.conf until the upgrade is applied
- Bind the admin listener to 127.0.0.1 and require SSH tunneling for administrative access
- Run the Coturn database account with least privilege and revoke pg_execute_server_program or superuser rights where applicable
# Configuration example: disable the admin web interface in turnserver.conf
# Comment out or remove the following lines
# web-admin
# web-admin-listen-ip=0.0.0.0
# web-admin-listen-port=443
# If admin access is required, restrict it to localhost only
web-admin-listen-ip=127.0.0.1
web-admin-listen-port=8080
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
