Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1 open-ils.fielder OpenSRF Service /osrf-gateway-v1 sql injection

Summaryinfo

A vulnerability marked as critical has been reported in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The impacted element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Performing a manipulation results in sql injection. This vulnerability is reported as CVE-2026-19926. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. This affects an unknown code of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at bugs.launchpad.net. This vulnerability is uniquely identified as CVE-2026-19926. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1505 for this issue.

The exploit is shared for download at bugs.launchpad.net. It is declared as proof-of-concept.

Upgrading to version 3.14.12, 3.15.12, 3.16.6 or 3.17-beta2 eliminates this vulnerability. The upgrade is hosted for download at evergreen-ils.org.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Evergreen

Version

• 3.14.0
• 3.14.1
• 3.14.2
• 3.14.3
• 3.14.4
• 3.14.5
• 3.14.6
• 3.14.7
• 3.14.8
• 3.14.9
• 3.14.10
• 3.14.11
• 3.15.0
• 3.15.1
• 3.15.2
• 3.15.3
• 3.15.4
• 3.15.5
• 3.15.6
• 3.15.7
• 3.15.8
• 3.15.9
• 3.15.10
• 3.15.11
• 3.16.0
• 3.16.1
• 3.16.2
• 3.16.3
• 3.16.4
• 3.16.5
• 3.17-beta1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #871976: evergreen-ils evergreen 3.14.0 SQL Injection (by hacklantic)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion