CVE-2026-21892 Parsl Monitoring Visualization Vulnerable to SQL Injection
An unauthenticated attacker can inject SQL commands into the Parsl visualization dashboard via the workflow_id parameter, leading to data exfiltration or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21892?
CVE-2026-21892 is a medium-severity SQL injection vulnerability in parsl, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.
Weakness: CWE-89
Which versions are affected by CVE-2026-21892?
3 open source packages ship an affected version, including parsl. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
parsl PyPI | All versions | 2026.01.05 |
parsl PyPI | All versions | 2026.01.05 |
parsl PyPI | All versions | 2026.01.05 |
Products include Uchicago Parsl.
How do I fix CVE-2026-21892?
Upgrade parsl to 2026.01.05 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-21892 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21892 exists.
Sources
Also known as DEBIAN-CVE-2026-21892, DSA-6099-1, GHSA-f2mf-q878-gh58, PYSEC-2026-1759, UBUNTU-CVE-2026-21892, USN-8505-1.