CVE-2026-28438
Last modified
CVE-2026-28438 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cocoindex | Cocoindex | < 0.3.34 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-28438?
How severe is CVE-2026-28438?
How do I fix CVE-2026-28438?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-28431Misskey is an open source, federated social media platform. …7.5
- CVE-2026-28432Misskey is an open source, federated social media platform. …7.5
- CVE-2026-28433Misskey is an open source, federated social media platform. …4.3
- CVE-2026-28434cpp-httplib is a C++11 single-file header-only cross platfor…5.3
- CVE-2026-28435cpp-httplib is a C++11 single-file header-only cross platfor…7.5
- CVE-2026-28436Frappe is a full-stack web application framework. Prior to v…7.2
- CVE-2026-2844Missing Authentication for Critical Function vulnerability i…7.5
- CVE-2026-28442ZimaOS is a fork of CasaOS, an operating system for Zima dev…8.5
- CVE-2026-28443OpenReplay is a self-hosted session replay suite. Prior to v…9.8
- CVE-2026-28444Typebot is a chatbot builder tool. In versions 3.15.2 and pr…6.5
- CVE-2026-28445Typebot is a chatbot builder tool. In versions 3.15.2 and pr…8.7
- CVE-2026-28446OpenClaw versions prior to 2026.2.1 with the voice-call exte…9.8
Are you affected by CVE-2026-28438?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST