CVE-2026-7699 Overview
CVE-2026-7699 is a SQL injection vulnerability affecting Dromara MaxKey identity and access management software through version 3.5.13. The flaw resides in the StrUtils.checkSqlInjection function within StrUtils.java. Attackers can manipulate the filtersfields argument to inject SQL statements into backend queries. The vulnerability is exploitable remotely and requires only low-privileged authenticated access. A public proof-of-concept has been released, and the vendor did not respond to disclosure attempts. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Authenticated remote attackers can inject SQL through the filtersfields parameter, potentially exposing identity data managed by MaxKey.
Affected Products
- Dromara MaxKey versions up to and including 3.5.13
- The vulnerable component is StrUtils.java (StrUtils.checkSqlInjection function)
- Deployments exposing the affected filters endpoint to authenticated users
Discovery Timeline
- 2026-05-03 - CVE-2026-7699 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-7699
Vulnerability Analysis
The vulnerability stems from inadequate input neutralization in the StrUtils.checkSqlInjection routine. MaxKey is an open-source single sign-on and identity management product maintained under the Dromara organization. The checkSqlInjection helper is intended to sanitize untrusted input before it reaches database query construction. Because the filtersfields argument bypasses or defeats this check, attacker-controlled values reach SQL statements without proper neutralization. Successful exploitation can result in unauthorized data retrieval, modification of query logic, and exposure of credential or session metadata stored within MaxKey. The EPSS probability is 0.026% as of 2026-05-07, indicating low near-term exploitation likelihood despite public exploit availability.
Root Cause
The root cause is improper filtering of SQL metacharacters in user-controlled filtersfields input. The checkSqlInjection function performs blocklist-style validation rather than parameterized query enforcement. Blocklist sanitization is brittle and can be evaded through encoding, casing, or syntax variations the filter does not anticipate. The defect is consistent with [CWE-74] injection class weaknesses.
Attack Vector
An authenticated attacker submits a crafted HTTP request that supplies SQL syntax in the filtersfields parameter. The malformed input traverses the flawed sanitization routine and is concatenated into a backend SQL query. The attack does not require user interaction and can be performed over the network. Refer to the GitHub PoC Repository and VulDB Vulnerability #360868 for technical specifics.
No verified code sample is available in this advisory; the published proof-of-concept demonstrates parameter manipulation against the filters endpoint without requiring custom tooling.
Detection Methods for CVE-2026-7699
Indicators of Compromise
- HTTP requests containing SQL syntax (UNION, SELECT, --, ', OR 1=1) within the filtersfields parameter
- Application logs from MaxKey showing malformed or unusually long filter parameter values
- Database query errors or unexpected result sets correlated with filter-related endpoints
Detection Strategies
- Inspect MaxKey access logs and web application firewall telemetry for anomalous payloads targeting filter parameters
- Deploy WAF signatures for SQL injection patterns specifically scoped to MaxKey URI paths
- Correlate authentication events with database query anomalies to identify low-privileged accounts probing injection points
Monitoring Recommendations
- Forward MaxKey application logs and database audit logs to a centralized analytics platform for retention and search
- Establish baselines for normal filtersfields parameter values and alert on deviations
- Monitor for outbound data volume spikes from MaxKey hosts that may indicate SQL-driven exfiltration
How to Mitigate CVE-2026-7699
Immediate Actions Required
- Inventory all Dromara MaxKey deployments and confirm version against the affected range up to 3.5.13
- Restrict network access to MaxKey administrative and filter endpoints to trusted segments
- Review authentication logs for unexpected low-privileged accounts and rotate credentials where suspicious activity is identified
Patch Information
The vendor was contacted but did not respond to disclosure. No official patch is referenced in the available CVE data. Track the Dromara MaxKey project for upstream fixes and review the VulDB Vulnerability #360868 entry for status updates.
Workarounds
- Place MaxKey behind a web application firewall configured with SQL injection rules covering the filtersfields parameter
- Limit account provisioning so only required users can authenticate to MaxKey, reducing the pool of potential attackers
- Apply database-level least privilege so the MaxKey service account cannot read or modify tables outside its operational scope
# Example WAF rule sketch blocking SQL metacharacters in filtersfields
# Adjust to your WAF syntax (ModSecurity shown)
SecRule ARGS:filtersfields "@rx (?i)(union(\s+all)?\s+select|--|';|/\*|xp_)" \
"id:1026769901,phase:2,deny,status:403,msg:'CVE-2026-7699 MaxKey filtersfields SQLi'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
