CVE-2026-34717Disclosure(openproject / openproject)

LOWCVSS 8.1 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch openproject openproject systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3.

openproject CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/opf/openproject/security/advisories/GHSA-5rrm-6qmq-2364

Other references

https://github.com/opf/openproject/releases/tag/v17.2.3

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openproject

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked at 3 mentions on most recent observed day (2026-04-03)
5 total mentions across 2 days

Affected systems

Vendors

openproject

Products

openproject

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

240.0%

Patch

240.0%

General

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-02	2	Disclosure1Patch1
2026-04-03	3	Disclosure1General1Patch1

Full discourse5 posts

Infoflowcloud@infoflowcloud188d
General
🚨*CVE* CVE-2026-34717 OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds … https://www.cve.org/CVERecord?id=CVE-2026-34717 ----- Traducción: CVE-2026-34717 Ope… http://infoflow.cloud`
Post summary
The tweet merely references CVE‑2026‑34717 with a link to the CVE record, providing no additional technical details or context.
0000039
65 followersView on X
CVE@CVEnew188d
Patch
CVE-2026-34717 OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds … https://www.cve.org/CVERecord?id=CVE-2026-34717
Post summary
The text references CVE-2026-34717 and indicates that OpenProject versions earlier than 17.2.3 are affected, implying that version 17.2.3 contains the necessary fix.
00000254
56.9K followersView on X
The Hacker Wire@TheHackerWire189d
Disclosure
🔴 CVE-2026-34717 - Critical OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly i... https://www.thehackerwire.com/vulnerability/CVE-2026-34717/ https://t.co/nraNP2tu1y
Post summary
The tweet announces a critical vulnerability in OpenProject involving unsanitized user input, but does not provide PoC, exploit code, or mitigation details.
0000060
163 followersView on X
CVEFind.com@CveFindCom189d
Patch
[CVE-2026-34717: CRITICAL] Prior versions of OpenProject had a security flaw allowing SQL injection. Update to version 17.2.3 to patch this vulnerability. Keep your software secure!#cve,CVE-2026-34717,#cybersecurity https://cvefind.com/CVE-2026-34717
Post summary
The text alerts about a critical SQL injection in OpenProject and recommends updating to the 17.2.3 patch.
0000053
617 followersView on X
0day Signal@0dayPublishing189d
Disclosure
🚨 CVE-2026-34717: OpenProject: SQL Injection in Co... Raw SQL concatenation in cost reporting module turns authenticated users into database gods with CVSS 9.9 - check line ... https://zerodaysignal.com/vulnerability/CVE-2026-34717 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The text announces a new SQL injection flaw (CVE‑2026‑34717) in OpenProject’s cost reporting module with a CVSS score of 9.9, without mentioning exploits, patches, or active use in the wild.
0000087
193 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openproject	openproject	-	-	-

Explore more

Back to dashboard openproject CVEs openproject vulnerabilities

What researchers are saying

CVE-2026-34717

Infoflowcloud@infoflowcloudGeneral

The tweet merely references CVE‑2026‑34717 with a link to the CVE record, providing no additional technical details or context.

CVE@CVEnewPatch

The text references CVE-2026-34717 and indicates that OpenProject versions earlier than 17.2.3 are affected, implying that version 17.2.3 contains the necessary fix.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces a critical vulnerability in OpenProject involving unsanitized user input, but does not provide PoC, exploit code, or mitigation details.

CVEFind.com@CveFindComPatch

The text alerts about a critical SQL injection in OpenProject and recommends updating to the 17.2.3 patch.

0day Signal@0dayPublishingDisclosure

The text announces a new SQL injection flaw (CVE‑2026‑34717) in OpenProject’s cost reporting module with a CVSS score of 9.9, without mentioning exploits, patches, or active use in the wild.