CVE-2026-92796 in Manticore Search
Summary
by MITRE • 09/16/2026
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
Manticore Search versions prior to 28.4.4 contain a critical authorization bypass vulnerability stemming from an insufficient validation of permissions across multi-statement SQL requests. The core technical flaw lies in the query parser and execution engine, which processes multiple statements within a single request but fails to enforce access control checks on every individual statement after the first one. While the initial statement is correctly subjected to permission verification based on the user's role, subsequent statements are executed with elevated privileges or without any additional validation. This architectural oversight allows an attacker who possesses only read-only permissions for specific tables or indexes to append arbitrary SQL commands that would normally be restricted by administrative policies. The vulnerability effectively neutralizes the principle of least privilege by allowing a low-privileged account to perform actions reserved for database administrators, such as modifying system configurations or accessing sensitive metadata.
The operational impact of this flaw is severe, particularly in environments where Manticore Search handles authentication data or stores credentials within its indexed tables. An attacker can exploit this weakness by constructing a malicious SQL payload that begins with a legitimate SELECT statement to bypass the initial permission check, followed immediately by additional statements designed to extract sensitive information. Specifically, attackers have demonstrated the ability to query internal credential tables and retrieve password hashes associated with administrator accounts. Although these are hashed values rather than plaintext passwords, obtaining them facilitates offline brute-force attacks or pass-the-hash techniques if the hash algorithm is weak or known vulnerabilities exist in its implementation. This capability compromises the integrity of the authentication system and can lead to full administrative takeover of the search infrastructure, potentially exposing all indexed data and allowing further lateral movement within the network.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves an actor obtaining privileges or performing actions that they are not authorized to perform due to flawed access control logic. It also relates closely to CWE-732 Permission Issues in configuration files or database schemas where expected restrictions are bypassed through input manipulation. In the context of the MITRE ATT&CK framework, this behavior maps to T1098 Exploitation for Credential Access and potentially T1546 Event Triggered: Execution Override Mechanisms if used to alter system state. The attack vector is classified as Local or Network-adjacent depending on deployment, but it requires valid authentication credentials with read-only access, making it an authenticated remote code execution equivalent in terms of impact severity.
Mitigation strategies must prioritize immediate patching and architectural review. Organizations running Manticore Search versions 27.0.0 through 28.4.3 should upgrade to version 28.4.4 or later immediately, as this release addresses the permission validation logic for multi-statement queries. In environments where upgrading is not instantly feasible, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block SQL payloads containing multiple statement separators like semicolons within a single request string. Additionally, database administrators should audit user privileges rigorously, ensuring that read-only users do not have access to tables containing sensitive authentication data or system metadata. Implementing strict input validation at the application layer to sanitize multi-statement inputs before they reach the database engine provides an additional defense-in-depth measure. Regular security assessments and penetration testing focused on SQL injection and privilege escalation vectors are recommended to identify similar flaws in custom query handling logic.