CVE Intelligence

Chirpstack vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Chirpstack products: 1 record(s), with severity, exploitation and fixes.

Chirpstack 1

Exploited only (KEV) →

CVE-2026-71282 Medium · 6.5 CWE-89 Aug 5, 2026
ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter
ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.