CVE-2026-6093: Corteza MSSQL Backend SQLi Vulnerability

CVE-2026-6093 Overview

CVE-2026-6093 is a SQL injection vulnerability [CWE-89] affecting Corteza 2024.9.8. The flaw resides in the Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field. Authenticated attackers can manipulate the filter parameter to inject arbitrary SQL statements into queries executed against the MSSQL backend. Successful exploitation allows extraction of sensitive data stored in the Corteza database. The vulnerability is exploitable over the network with low attack complexity and requires low-privilege authentication.

Critical Impact
Authenticated attackers can inject SQL through the Compose records meta filter, leading to unauthorized disclosure of database contents in Corteza deployments backed by MSSQL.

Affected Products

Corteza 2024.9.8
Deployments using the Microsoft SQL Server (MSSQL) backend
Compose records filtering functionality

Discovery Timeline

2026-05-11 - CVE-2026-6093 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-6093

Vulnerability Analysis

The vulnerability resides in Corteza's Compose module, which manages structured records. When the MSSQL backend processes filter expressions that reference the meta field, user-supplied input is concatenated into the resulting SQL statement without adequate parameterization or sanitization. This breaks the boundary between query structure and user data, classifying the issue under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

An authenticated attacker with permission to query Compose records can craft a filter expression containing SQL metacharacters. The MSSQL backend then executes the modified statement, allowing the attacker to read confidential data outside their authorization scope. The vector requires network access and authenticated access with low privileges.

Root Cause

The root cause is unsafe construction of MSSQL query fragments when filtering on the meta field of Compose records. Filter values flow into the SQL builder without being bound as parameters, leaving the query susceptible to injection. The defect is specific to the MSSQL adapter path and does not necessarily affect alternative database backends.

Attack Vector

An attacker authenticates to the Corteza instance and issues a request to list or filter Compose records. The attacker supplies a malicious filter referencing the meta field with SQL syntax appended. The MSSQL backend executes the injected SQL, returning results that disclose data from the underlying database. Refer to the Fluid Attacks Advisory for technical details and the GitHub Corteza Project for source code context.

No verified exploit code is published. See the Fluid Attacks advisory
for a technical description of the injection point in the Compose
records `meta` filter against the MSSQL backend.

Detection Methods for CVE-2026-6093

Indicators of Compromise

Unusual or malformed filter strings referencing the meta field in Corteza Compose API requests
MSSQL error messages or syntax errors logged when processing record filter queries
Authenticated sessions issuing high volumes of record filter requests with SQL metacharacters such as ', --, ;, or UNION

Detection Strategies

Inspect Corteza application logs for filter expressions on Compose records containing SQL keywords or stacked queries
Enable MSSQL query auditing to capture statements executed by the Corteza service account and review for unexpected UNION, SELECT, or schema queries
Deploy a Web Application Firewall (WAF) rule set targeting SQL injection patterns on Corteza Compose record endpoints

Monitoring Recommendations

Monitor authenticated API calls to /compose/namespace/*/module/*/record/ endpoints for anomalous filter payloads
Alert on MSSQL errors originating from the Corteza application user account
Track baseline query volumes and flag deviations that may indicate automated injection probing

How to Mitigate CVE-2026-6093

Immediate Actions Required

Identify all Corteza 2024.9.8 instances configured with an MSSQL backend and inventory their exposure
Restrict network access to the Corteza application to trusted users and management networks until a patched version is deployed
Review Corteza role assignments and reduce record read permissions to the minimum necessary
Audit recent logs for evidence of filter-based SQL injection attempts against Compose record endpoints

Patch Information

Review the GitHub Corteza Project repository for security releases addressing this issue. Apply the vendor-provided update for Corteza versions beyond 2024.9.8 once available, and validate the fix against the MSSQL backend path. Refer to the Fluid Attacks Advisory for additional remediation guidance.

Workarounds

Switch the database backend from MSSQL to a non-affected backend such as PostgreSQL where operationally feasible
Place a WAF in front of Corteza and block requests containing SQL metacharacters in Compose record filter parameters
Revoke or limit roles that allow filtering Compose records until a patched build is installed

bash

# Example WAF rule pattern (ModSecurity) to flag SQLi attempts on Corteza Compose filters
SecRule ARGS:filter "@rx (?i)(union[\s\/\*]+select|--|;|/\*|xp_cmdshell|information_schema)" \
    "id:1026093,phase:2,deny,status:403,log,msg:'Possible CVE-2026-6093 SQLi on Corteza Compose meta filter'"