CVE-2026-77874
Description
A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.
Statement
This flaw is rated as Important. An authenticated remote attacker can bypass authorization controls and exfiltrate data from the underlying database by injecting SQL through the JSON path parameter in Hibernate ORM. This is due to improper escaping of the leading JSON path segment in certain database dialects, which is reachable in default configurations of applications using Hibernate ORM's Criteria API.
Mitigation
To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Adversaries could execute system commands, typically by changing the SQL statement to redirect output to a file that can then be executed.
Confidentiality
Technical Impact: Read Application Data
Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities.
Authentication
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
If poor SQL commands are used to check user names and passwords or perform other kinds of authentication, it may be possible to connect to the product as another user with no previous knowledge of the password.
Access Control
Technical Impact: Bypass Protection Mechanism
If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability.
Integrity
Technical Impact: Modify Application Data
Just as it may be possible to read sensitive information, it is also possible to modify or even delete this information with a SQL injection attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
