CVE-2026-57230 in OpenReplay
Summary
by MITRE • 07/11/2026
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/11/2026
The vulnerability identified in OpenReplay versions prior to 1.27.0 represents a critical server-side parameter injection flaw that specifically targets the enterprise edition's multi-tenancy functionality. This issue stems from inadequate input validation and sanitization within the session search and analytics API components, where user-provided data is directly incorporated into ClickHouse database queries without proper escaping mechanisms. The vulnerability manifests in two distinct query insertion points that collectively enable authenticated attackers to exploit blind boolean-based and time-based SQL injection techniques against the underlying ClickHouse database infrastructure.
The technical exploitation of this vulnerability occurs through the manipulation of session search parameters and analytics queries that are processed within the enterprise multi-tenancy environment. Attackers can craft malicious inputs that bypass normal query construction processes, allowing them to extract data from any table within the ClickHouse database through carefully constructed blind injection attacks. The boolean-based and time-based exfiltration methods leverage the database's response timing characteristics and conditional logic evaluation to systematically retrieve information without direct output mechanisms. This approach allows attackers to enumerate database schemas, extract user credentials, session data, and potentially sensitive project information through iterative query construction and response analysis.
The operational impact of this vulnerability extends beyond simple data exfiltration to include complete disruption of the session search functionality for all users within the affected environment. When exploited, the malicious queries can cause cascading failures in the system's ability to properly process and display session data, effectively breaking core application functionality until administrative intervention removes the malicious stored keys from the database. This represents a significant degradation of service that affects not only data confidentiality but also system availability and integrity within the multi-tenant architecture. The vulnerability particularly impacts enterprise deployments where multiple organizations share the same OpenReplay instance, as it allows cross-tenant data access and potential information leakage between separate projects.
The security implications align with CWE-94, which describes improper control of generation of code, specifically in the context of insecure dynamic code generation within database query construction. This vulnerability also maps to ATT&CK technique T1213.002 for credential access through data from network shared disk, and T1071.004 for application layer protocol manipulation. The attack vector requires an authenticated user account, making it a privilege escalation issue that can be leveraged by insiders or compromised accounts to gain unauthorized access to sensitive information. Organizations should implement immediate mitigations including upgrading to OpenReplay version 1.27.0, which includes proper input sanitization and query parameterization mechanisms. Additional defensive measures should involve implementing strict input validation policies, database query logging for anomalous patterns, and regular security scanning of API endpoints to prevent similar injection vulnerabilities in the future.
The vulnerability demonstrates the critical importance of input validation in multi-tenant applications where user data flows through shared infrastructure components. The lack of proper escaping mechanisms in two separate query construction points created a pathway for attackers to bypass normal access controls and database security boundaries. This highlights the need for comprehensive security testing of API interfaces, particularly those handling user-provided search parameters and analytics queries. Organizations should also consider implementing database activity monitoring and alerting systems to detect anomalous query patterns that may indicate injection attacks, as well as establishing secure coding practices that mandate parameterized queries and proper input sanitization for all database interactions within enterprise applications.