vulnwire
5.4med

CVE-2026-57230

OpenReplay: Authenticated ClickHouse SQL injection via session search

Published 3 mo ago · modified 3 mo ago · JSON

CVSS
5.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 27%
Public exploits
0
none known

OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction (EPSS)

0.34% probability of exploitation in the next 30 days, higher than 27% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.15.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L
CNA3.15.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L

Affected products

  • openreplay openreplay

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • github.com /openreplay/openreplay/security/advisories/GHSA-vxf8-j7jx-p65x · x_refsource_CONFIRM
  • github.com /openreplay/openreplay/pull/4715 · x_refsource_MISC
  • github.com /openreplay/openreplay/commit/ae8de6893250dd41175c6b2d312545c515fa5a16 · x_refsource_MISC
  • github.com /openreplay/openreplay/releases/tag/v1.27.0 · x_refsource_MISC

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.