Chirpstack Chirpstack vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Chirpstack Chirpstack: 1 record(s), with affected versions and fixes.

CVE-2026-71282 Medium · 6.5 CWE-89 Aug 5, 2026

ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.