CVE-2026-57230— OpenReplay: Authenticated ClickHouse SQL injection via session search
Possible ATT&CK Techniques 3AI
T1114 · Email Collection T1059 · Command and Scripting Interpreter T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57230
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenReplay: Authenticated ClickHouse SQL injection via session search
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| openreplay | openreplay | < 1.27.0 | - |
II. Public POCs for CVE-2026-57230
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57230
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57230 (2)
Vendor Advisories for CVE-2026-57230 (1)
Vendor Pages for CVE-2026-57230 (1)
- 🔗 Release v1.27.0 · openreplay/openreplay · GitHubx_refsource_MISC
Same Patch Batch · openreplay · 2026-07-10 · 4 CVEs total
| CVE-2026-55879 | 9.3 CRITICAL | OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover |
| CVE-2026-55880 | 7.1 HIGH | OpenReplay: Cross-user IDOR in notes and dashboard widgets |
| CVE-2026-55881 | OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in |
IV. Related Vulnerabilities
Same product: openreplay
- CVE-2026-55881
OpenReplay: Cross-tenant session replay disclosure via missi - CVE-2026-55880
OpenReplay: Cross-user IDOR in notes and dashboard widgets - CVE-2026-55879
OpenReplay: Unauthenticated stored XSS leads to dashboard ac - CVE-2026-45296
OpenReplay: Cross-tenant information disclosure in app_apike - CVE-2026-45297
Cross-tenant IDOR on feature-flag and assist-stats routes vi
Same vendor: openreplay
- CVE-2026-55881
OpenReplay: Cross-tenant session replay disclosure via missi - CVE-2026-55880
OpenReplay: Cross-user IDOR in notes and dashboard widgets - CVE-2026-55879
OpenReplay: Unauthenticated stored XSS leads to dashboard ac - CVE-2026-45296
OpenReplay: Cross-tenant information disclosure in app_apike - CVE-2026-45297
Cross-tenant IDOR on feature-flag and assist-stats routes vi
Same weakness: CWE-89
- CVE-2026-15081
Location Selector - Critical - SQL Injection - SA-CONTRIB-20 - CVE-2026-13242
Geolocation Field - Critical - SQL Injection - SA-CONTRIB-20 - CVE-2026-47199
Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE - CVE-2026-55405
LangChain4j: SQL injection via metadata filters in langchain - CVE-2026-11321
GLPI DataInjection Plugin Authenticated SQL Injection via CS
V. Comments for CVE-2026-57230
No comments yet