CVE-2026-75132: WAPT Server SQL Injection Vulnerability

CVE-2026-75132 Overview

CVE-2026-75132 is a SQL injection vulnerability [CWE-89] in WAPT Server versions 2.6.1.17834 and earlier. The flaw resides in the columns parameter of the GET /api/v3/hosts API endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. Successful exploitation lets the attacker bypass host scope restrictions applied to their account and read data from other rows or tables in the backing database.

Critical Impact
Authenticated read-only users can extract data outside their authorized scope, breaking multi-tenant isolation in WAPT-managed environments.

Affected Products

WAPT Server versions 2.6.1.17834 and earlier
WAPT /api/v3/hosts REST API component
PostgreSQL backend accessed through the WAPT Server

Discovery Timeline

2026-08-31 - CVE-2026-75132 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-75132

Vulnerability Analysis

The vulnerability exists in the request-handling logic for the GET /api/v3/hosts endpoint. The columns parameter is concatenated into a dynamically constructed PostgreSQL query without adequate sanitization or parameterization. As a result, the attacker-controlled value is parsed as part of the SQL statement rather than as data.

This endpoint is intended to return host inventory information scoped to the caller's assigned hosts. Because the injection point sits inside the SELECT list, an attacker can append PostgreSQL expressions, subqueries, or function calls that reference tables and rows outside the caller's assigned scope. The server executes the resulting query with the privileges of the WAPT database role, not the low-privilege API user.

Refer to the VulnCheck SQL Injection Advisory for further technical context.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The columns parameter values are interpolated directly into the query string. WAPT does not enforce an allowlist of valid column identifiers, nor does it use parameterized queries or a query builder that escapes identifiers.

Attack Vector

Exploitation requires network access to the WAPT Server API and valid credentials for a WAPT account, even one restricted to read-only privileges. The attacker issues a crafted HTTP GET request to /api/v3/hosts with a malicious columns parameter containing PostgreSQL expressions or subqueries. The injected SQL is evaluated server-side, allowing the attacker to read data from rows or tables the account should not be able to access.

No verified proof-of-concept code has been published. See the VulnCheck advisory for exploitation specifics.

Detection Methods for CVE-2026-75132

Indicators of Compromise

Requests to /api/v3/hosts where the columns query parameter contains SQL keywords such as SELECT, FROM, UNION, CASE, or PostgreSQL functions like pg_sleep or current_database.
Unusually long or URL-encoded columns values on the hosts endpoint.
Read-only API accounts issuing high volumes of /api/v3/hosts requests with varied columns payloads consistent with automated injection tooling.

Detection Strategies

Enable verbose WAPT Server access logging and forward it to a SIEM for query-parameter inspection.
Enable PostgreSQL query logging on the WAPT database and alert on queries that reference tables outside the expected hosts schema originating from the WAPT service account.
Deploy a web application firewall (WAF) signature or rule set that flags SQL syntax inside the columns parameter of the WAPT API.

Monitoring Recommendations

Baseline normal columns parameter values used by legitimate WAPT consoles and integrations, then alert on deviations.
Correlate authenticated API calls with the account's assigned host scope; flag responses that include host data outside that scope.
Monitor for read-only accounts triggering PostgreSQL errors or unusually large result sets on the /api/v3/hosts endpoint.

How to Mitigate CVE-2026-75132

Immediate Actions Required

Upgrade WAPT Server to a version later than 2.6.1.17834 as listed in the WAPT Changelog Document.
Restrict network exposure of the WAPT Server API to trusted management networks and administrator workstations.
Rotate credentials for all WAPT accounts, including read-only API accounts, after patching.
Audit WAPT and PostgreSQL logs for prior exploitation attempts against /api/v3/hosts.

Patch Information

Tracapes has addressed the vulnerability in a WAPT Server release published after 2.6.1.17834. Consult the WAPT Changelog Document for the exact fixed version and upgrade instructions.

Workarounds

Block or filter requests to /api/v3/hosts that contain SQL metacharacters or reserved keywords in the columns parameter using a reverse proxy or WAF.
Reduce the number of accounts with API access to the WAPT Server, and remove unused read-only accounts.
Restrict the PostgreSQL role used by WAPT to the minimum privileges required, limiting the blast radius of a successful injection.

bash

# Example NGINX rule to block SQL keywords in the columns parameter
location /api/v3/hosts {
    if ($arg_columns ~* "(select|union|from|case|pg_sleep|;|--)") {
        return 403;
    }
    proxy_pass http://wapt_backend;
}