CVE-2026-121009
Description
A flaw was found in SQL::Abstract. The library fails to enforce its injection validation guard when function names are specified using the explicit -func argument, placing the input directly into database queries without verification. A remote attacker who can control function name inputs in an application could exploit this flaw to perform SQL (Structured Query Language) injection. This could allow an attacker to execute arbitrary database commands, potentially leading to unauthorized data disclosure or modification.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict injection guard validation or an explicit allowlist on all function names passed to SQL::Abstract queries using the explicit -func syntax: upgrade to SQL::Abstract 2.000001_04 (or the fixed Perl Sql Abstract builds), which invokes `_assert_pass_injection_guard` on the function name in `_expand_func` to reject unvalidated input, closing crafted function name in explicit -func syntax. Until patched, this is a concern on Applications passing user-controlled input into SQL::Abstract queries using the explicit { -func => [ $name, ... ] } structure, so Validate and restrict function names against an explicit allowlist before passing them into SQL::Abstract explicit -func structures. As a compensating measure, Deploy a Web Application Firewall to detect and block incoming HTTP requests containing SQL injection syntax in parameter values destined for the query builder and Restrict database account permissions to the minimum necessary tables and operations to limit the impact of commands executed via SQL injection. These controls limit blast radius and contain exploitation, but they do not fix the underlying unvalidated function name SQL injection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1305 SQL Injection Prevention (Parameterized Queries) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Adversaries could execute system commands, typically by changing the SQL statement to redirect output to a file that can then be executed.
Confidentiality
Technical Impact: Read Application Data
Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities.
Authentication
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
If poor SQL commands are used to check user names and passwords or perform other kinds of authentication, it may be possible to connect to the product as another user with no previous knowledge of the password.
Access Control
Technical Impact: Bypass Protection Mechanism
If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability.
Integrity
Technical Impact: Modify Application Data
Just as it may be possible to read sensitive information, it is also possible to modify or even delete this information with a SQL injection attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
