Bug 2436339 (CVE-2026-1287)

Summary:	CVE-2026-1287 Django: Django: SQL Injection via crafted column aliases
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anthomas, brasmith, caswilli, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, erezende, ggainey, jjoyce, jlanda, jmitchel, jschluet, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lhh, mattdavi, mburns, mgarciac, mhulan, mminar, nmoumoul, omaciel, osousa, pbohmill, pcreech, rbiba, rchan, simaishi, smallamp, smcdonal, sskracic, stcannon, teagle, tmalecek, tpfromme, ttakamiy, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to `QuerySet` methods like `annotate()` or `values()`, it can lead to the execution of arbitrary SQL commands. This could result in unauthorized access to sensitive data or modification of information within the database.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2436719, 2436698, 2436703, 2436713, 2436714, 2436717
Bug Blocks:

Description OSIDB Bzimport 2026-02-03 15:01:26 UTC

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Solomon Kebede for reporting this issue.

Comment 5 errata-xmlrpc 2026-03-06 10:13:42 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:3958 https://access.redhat.com/errata/RHSA-2026:3958

Comment 6 errata-xmlrpc 2026-03-06 10:55:48 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Red Hat Ansible Automation Platform 2.5 for RHEL 9

Via RHSA-2026:3959 https://access.redhat.com/errata/RHSA-2026:3959

Comment 7 errata-xmlrpc 2026-03-26 20:26:18 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:5970 https://access.redhat.com/errata/RHSA-2026:5970

Comment 8 errata-xmlrpc 2026-03-26 20:26:40 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:5971 https://access.redhat.com/errata/RHSA-2026:5971