CVE-2026-44349 Daptin fuzzy search injects unvalidated column name into raw SQL
An authenticated user can exploit unvalidated column names in fuzzy search to perform SQL injection and read the entire database.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44349?
CVE-2026-44349 is a high-severity SQL injection vulnerability in daptin, published on 7 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.L(fmt.Sprintf("LOWER(%s) LIKE ?", prefix+col)) raw SQL with no column whitelist check. The entry point is GET /api/<entity> with operator=fuzzy (or fuzzy_any, fuzzy_all). Any authenticated user — including one who self-registered with no admin involvement — can read the entire database. This issue has been patched in version 0.11.5.
Weakness: CWE-89
Which versions are affected by CVE-2026-44349?
3 open source packages ship an affected version, including github.com/daptin/daptin.
| Package | Affected | Fixed in |
|---|---|---|
github.com/daptin/daptin Go | All versions | 0.11.5 |
github.com/daptin/daptin Go | All versions | 0.11.5 |
github.com/daptin/daptin Go | All versions | 0.11.5 |
How do I fix CVE-2026-44349?
Upgrade github.com/daptin/daptin to 0.11.5 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-44349 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44349 exists.
Sources
Also known as GHSA-pwqg-q8pg-pp6r, GO-2026-5555.