CVE-2026-42097 Authentication Bypass in Sparx Pro Cloud Server

Critical 9.3 Published 19 May 2026 Updated 19 May 2026

Attackers can bypass authentication and execute SQL queries by omitting a query parameter, potentially leading to code execution and data access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-42097?

CVE-2026-42097 is a critical authentication bypass vulnerability in Sparx Systems Pro Cloud Server, published on 19 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Weakness: CWE-639

Which versions are affected by CVE-2026-42097?

It affects 1 product.

Products include Sparxsystems Pro Cloud Server.

How do I fix CVE-2026-42097?

No fix has been published for CVE-2026-42097 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-42097 being exploited?

There is no known exploitation of CVE-2026-42097 in the wild and no public exploit code.

Sources

Also known as GHSA-hf6p-xc3f-p4f9.