CVE-2026-57190
Description
A flaw was found in Asterisk. When the PostgreSQL or TDS Channel Event Logging (CEL) backends are enabled and custom event data is logged without proper validation, an attacker can supply malicious input to trigger SQL injection. This vulnerability allows an attacker to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data disclosure, data modification, or service disruption.
Statement
This vulnerability is rated as Important because untrusted network input passed to telephony event routines can result in arbitrary SQL injection, allowing an attacker to manipulate backend database records and extract sensitive information without authentication. Exploitation is contingent upon specific prerequisites, requiring both the explicit configuration of PostgreSQL or TDS logging backends and custom dialplans that route unsanitized user arguments to event handlers. Asterisk is not packaged or supported within Red Hat Enterprise Linux or other Red Hat product portfolios, resulting in no direct exposure for standard Red Hat deployments.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to sanitize and escape user-defined event names before SQL query concatenation in cel_pgsql and cel_tds Channel Event Logging backends: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 (or the fixed Asterisk builds), which escape the user-defined event name with PQescapeStringConn() in cel_pgsql and filter through anti_injection() in cel_tds before query concatenation, closing all 2 injection vectors (untrusted event name injection via cel_pgsql logging backend, untrusted event name injection via cel_tds logging backend). Until patched, this is a concern on Asterisk deployments using cel_pgsql or cel_tds with dialplans passing untrusted input to CELGenUserEvent, so Audit dialplans to restrict and validate input passed to CELGenUserEvent against an allowlist, or avoid routing unsanitized user arguments to event handlers. As a compensating measure, Restrict database account permissions for logging backends to INSERT on event tables and Enforce an allowlist of valid event names in dialplan input before passing values to CELGenUserEvent. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper SQL escaping defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1305 SQL Injection Prevention (Parameterized Queries) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Adversaries could execute system commands, typically by changing the SQL statement to redirect output to a file that can then be executed.
Confidentiality
Technical Impact: Read Application Data
Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities.
Authentication
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
If poor SQL commands are used to check user names and passwords or perform other kinds of authentication, it may be possible to connect to the product as another user with no previous knowledge of the password.
Access Control
Technical Impact: Bypass Protection Mechanism
If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability.
Integrity
Technical Impact: Modify Application Data
Just as it may be possible to read sensitive information, it is also possible to modify or even delete this information with a SQL injection attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
