CVE-2026-57230: OpenReplay SQL Injection Vulnerability

CVE-2026-57230 Overview

CVE-2026-57230 is a SQL injection vulnerability [CWE-89] in OpenReplay, a self-hosted session replay suite. The flaw affects the session search and analytics API in enterprise editions with multi-tenancy enabled. Prior to version 1.27.0, the API constructed ClickHouse queries by inserting user input directly into the query string. Two input positions were not escaped, allowing an authenticated member to inject arbitrary SQL. Attackers can read any ClickHouse table using blind boolean-based and time-based exfiltration techniques. Stored malicious input can also break session search for all viewers of a project until the offending key is manually removed. The maintainers fixed the issue in version 1.27.0.

Critical Impact
Authenticated attackers can exfiltrate arbitrary ClickHouse table contents and cause a persistent denial of session search functionality within affected projects.

Affected Products

OpenReplay enterprise editions prior to 1.27.0
OpenReplay deployments with multi-tenancy enabled
OpenReplay session search and analytics API components

Discovery Timeline

2026-07-10 - CVE-2026-57230 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57230

Vulnerability Analysis

The vulnerability resides in the session search and analytics API of OpenReplay enterprise builds with multi-tenancy enabled. The backend builds ClickHouse queries via string concatenation using values supplied by authenticated members. Two of those positions accept input without escaping or type validation, producing a classic SQL injection sink [CWE-89].

An authenticated tenant member can inject payloads that alter query logic. Because responses do not directly return injected data, exploitation uses out-of-band techniques. Blind boolean-based injection infers data through response differences. Time-based injection uses ClickHouse sleep and delay primitives to leak bytes. Both approaches allow reading arbitrary rows from any ClickHouse table accessible to the API service account, including data belonging to other tenants.

The second impact is persistent. A crafted filter value can be stored as part of a saved search or project configuration. Once persisted, every subsequent session search request in that project executes the malformed query, breaking search functionality for all viewers until an administrator removes the stored key.

Root Cause

The root cause is unsafe query construction. The API concatenates numeric filter values into ClickHouse SQL without parameterization or numeric validation. The patch in pull request #4715 introduces validation of numeric filter values in session search analytics before query assembly.

Attack Vector

Exploitation requires an authenticated tenant account and user interaction with the analytics API. The attacker submits crafted filter payloads through the session search interface. Delivery is network-based against the API endpoint.

text

// Patch reference: backend/go.mod dependency update accompanying the fix
// Source: https://github.com/openreplay/openreplay/commit/ae8de6893250dd41175c6b2d312545c515fa5a16

	github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce
	github.com/ua-parser/uap-go v0.0.0-20251207011819-db9adb27a0b8
	go.uber.org/zap v1.27.1
-	golang.org/x/net v0.53.0
+	golang.org/x/net v0.55.0
)

The primary code fix, per the GitHub Pull Request #4715, validates numeric filter values in session search before they reach the ClickHouse query builder.

Detection Methods for CVE-2026-57230

Indicators of Compromise

ClickHouse query logs containing sleep(, SLEEP, or timing functions originating from the OpenReplay analytics service account
Session search API requests with non-numeric characters in fields expected to hold integers
Persistent errors or timeouts in session search for all users of a specific project
Anomalous read access from the OpenReplay service role to ClickHouse tables outside of expected session and event tables

Detection Strategies

Review ClickHouse query logs for statements containing conditional expressions, unions, or sleep-based delays tied to the OpenReplay backend user
Correlate authenticated tenant member activity with unusually high query volume or latency in the analytics endpoints
Alert on repeated failed queries from the OpenReplay API tied to a single project or saved filter

Monitoring Recommendations

Enable ClickHouse query_log and forward logs to a centralized analytics or SIEM platform for retention and search
Monitor OpenReplay API request patterns for authenticated users issuing large numbers of session search requests with varying filter payloads
Track application error rates for the session search endpoint and alert on sustained failures scoped to a single project

How to Mitigate CVE-2026-57230

Immediate Actions Required

Upgrade OpenReplay to version 1.27.0 or later, which contains the validation fix from pull request #4715
Audit saved filters, searches, and project configurations for non-numeric values in numeric fields and remove suspicious entries
Review ClickHouse audit logs for evidence of exfiltration queries executed by the OpenReplay service account
Rotate any credentials or secrets that may have been stored in ClickHouse tables accessible to the API service role

Patch Information

The fix is available in OpenReplay v1.27.0. The remediation is tracked in GHSA-vxf8-j7jx-p65x and implemented in commit ae8de68 via pull request #4715.

Workarounds

Restrict access to the session search and analytics API to trusted tenant administrators until the upgrade is applied
Apply least-privilege permissions to the ClickHouse account used by OpenReplay, limiting it to only the tables required for session replay
Temporarily disable multi-tenancy features on affected deployments if an upgrade cannot be scheduled immediately

bash

# Upgrade OpenReplay to the patched release
git fetch --tags
git checkout v1.27.0

# Verify running version after deployment
kubectl -n openreplay get deployments -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'