Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-57190— Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

Quick assessment

Affected

asterisk asterisk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一个开源的专用分支交换机（PBX）和电话工具包。在 Asterisk 20.20.1、21.12.3、22.10.1、23.4.1 以及认证版 Asterisk 20.7-cert11、22.8-cert3 之前的版本中，当拨号计划应用程序将不可信数据写入 CEL（Channel Event Log）的列时，PostgreSQL 和 TDS/MSSQL 通道事件日志后端（即和）可能允许执行任意 SQL 语句。该漏洞的触发需要同时满足以下条件：或后端已加载并配置，且管理员在拨号计划中调

CVSS 7.0 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

Source: CVE Program / CVE List V5

Vulnerability Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
asterisk	asterisk	< 20.20.1	-
asterisk	certified-asterisk	< 20.7-cert11	-

II. Public POCs for CVE-2026-57190

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57190

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57190 (7)

🔗 GitHub - asterisk/asterisk at 24.0.0-pre1 · GitHub x_refsource_MISC
🔗 Release Asterisk Release 23.4.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 21.12.3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 20.20.1 · asterisk/asterisk · GitHub Read full article x_refsource_MISC
🔗 Release Asterisk Release 22.10.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-22.8-cert3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-20.7-cert11 · asterisk/asterisk · GitHub x_refsource_MISC

Other References for CVE-2026-57190 (8)

https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/88c65757b56c716b5a175f35941be22e038b256f x_refsource_MISC
https://github.com/asterisk/asterisk/commit/046a8b0b50623d80926c1adc2eca1c9c17e258ed x_refsource_MISC
https://github.com/asterisk/asterisk/commit/0a86e45e8cde7630276f8363de45f71d1635d2f4 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/a04bee3992c28e1681457370e46f30494b7c6619 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/ff21d90e61d199db9b963c671d125a1e917d41ac x_refsource_MISC
https://github.com/asterisk/asterisk/commit/8cb6dfd41debb2259ec3a33ccfa78f1d902e4c22 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/8bf7746d01221d6d2bcfcd46ba7a1cff066a1a8b x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57190

Same Patch Batch · asterisk · 2026-10-27 · 16 CVEs total

CVE-2026-57191	8.2 HIGH	Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
CVE-2026-57202	8.1 HIGH	Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197	7.7 HIGH	Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201	7.5 HIGH	Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57195	7.5 HIGH	Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
CVE-2026-57200	7.5 HIGH	Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and c
CVE-2026-57186	7.5 HIGH	Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
CVE-2026-57188	7.1 HIGH	Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57203	6.9 MEDIUM	Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper locati
CVE-2026-57185	6.5 MEDIUM	Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57192	6.0 MEDIUM	Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
CVE-2026-57194	5.9 MEDIUM	Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198	2.3 LOW	Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189	2.3 LOW	Asterisk: Possible RED T.140 Generation Accumulation OOB Write
CVE-2026-57199	2.3 LOW	Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct

IV. Related Vulnerabilities

Same product: asterisk

Same vendor: asterisk

Same weakness: CWE-89