Product:
Observability Self-Hosted
Summary
SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account. Attackers can exploit this vulnerability to gain unauthorized access to sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-26392 |
Exploitation
To exploit this vulnerability, an attacker must have access to the network and authenticate using a low-privilege account. Once authenticated, the attacker can craft specific SQL queries that manipulate the database, potentially revealing sensitive data that should not be accessible to low-privilege users.
Affected Products
- SolarWinds Observability Self-Hosted: Vulnerable to SQL injection, allowing unauthorized data access with low-privilege accounts.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by SolarWinds. Additionally, organizations should review their access controls and limit the privileges of low-level accounts to minimize the risk of exploitation.