CVE-2026-39196Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR138d
Patch
CVE-2026-39196 — Vector (Datadog) ClickHouse sink: SQL/identifier injection. ≤v0.54.0 escaped `table` but interpolated `database` raw into the INSERT — a crafted database value breaks out of identifier quoting. Fixed in v0.55.0 (PR #25591) via server-side :Identifier params.
Post summary
A SQL/identifier injection flaw in Vector's ClickHouse sink (CVE‑2026‑39196) affecting versions ≤0.54.0 has been disclosed and fixed in v0.55.0 with server‐side identifier handling.
0000091
217 followersView on X

Explore more

Back to dashboard