CVE-2026-57190 in Asterisk
Summary
by MITRE • 10/27/2026
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
Asterisk serves as a widely deployed open-source private branch exchange and telephony toolkit that facilitates complex voice communication architectures across enterprise environments. Within this ecosystem, the Channel Event Log subsystem provides critical observability by recording detailed information about call events for auditing, billing, or real-time monitoring purposes. The integrity of these logs is paramount because they often feed into downstream analytics platforms, security information and event management systems, or database-backed reporting tools that rely on structured data inputs to function correctly without unexpected behavior or errors.
The identified vulnerability resides specifically within the PostgreSQL cel_pgsql and TDS/MSSQL cel_tds Channel Event Log backends. These modules are responsible for translating internal Asterisk channel events into SQL INSERT statements directed at external relational database servers. The core technical flaw is a classic injection weakness where user-supplied or dialplan-controlled data is incorporated directly into SQL queries without adequate sanitization or parameterization. Specifically, the eventtype column in the CEL table becomes an attack vector when untrusted data is passed to it via the CELGenUserEvent dialplan application.
The operational mechanism of this exploitation requires specific configuration prerequisites and administrative actions within the Asterisk PBX environment. First, either the cel_pgsql or cel_tds backend module must be loaded and properly configured with database connection credentials. Second, an administrator or developer implementing custom dialplans must invoke the CELGenUserEvent application to generate a user-defined event entry in the log stream. If the value provided for this event type is not strictly validated against a whitelist of expected strings before being passed to the logging backend, malicious SQL syntax embedded within that string will be executed by the database server upon insertion.
This vulnerability maps directly to CWE-89 Improper Neutralization of Special Elements used in an SQL Command and aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter through its potential for remote code execution via stored procedures or extended commands if the underlying database engine permits such operations from within a standard INSERT statement context. The severity is elevated because it allows arbitrary SQL execution, which can lead to full compromise of the backend database server depending on the privileges assigned to the Asterisk service account connecting to PostgreSQL or MSSQL.
The impact extends beyond simple data corruption in the event log table. An attacker who gains control over the dialplan logic or exploits a separate vulnerability that allows injection into CELGenUserEvent parameters can manipulate, exfiltrate, or destroy critical telephony records and potentially pivot further into the network by leveraging database privileges to execute operating system commands if supported by the specific DBMS configuration. This undermines both the availability of call detail records essential for billing and compliance audits and the confidentiality of sensitive communication metadata stored within those logs.
Mitigation strategies prioritize immediate software updates as the primary remediation path. Organizations running affected versions must upgrade Asterisk to version 20.20.1, 21.12.3, 22.10.1, or 23.4.1 immediately, along with their respective Certified Asterisk variants such as 20.7-cert11 and 22.8-cert3 where applicable. These releases contain code changes that enforce proper input validation within the cel_pgsql and cel_tds modules to prevent arbitrary SQL execution from untrusted event types.
In addition to patching, defensive architectural measures should be implemented for environments undergoing transition or those unable to update immediately due to compatibility constraints. Administrators must ensure that any custom dialplan logic utilizing CELGenUserEvent strictly validates the input data against a predefined list of allowed values before passing it to the application. Furthermore, database access controls should follow the principle of least privilege by ensuring the Asterisk service account has only INSERT permissions on the specific log tables and lacks elevated privileges such as xp_cmdshell in MSSQL or superuser rights in PostgreSQL that could facilitate lateral movement or system-level compromise through SQL injection vectors.