Bug 2513586 (CVE-2026-19496)

Summary: CVE-2026-19496 sources-api-go: sources-api-go: SQL injection (CWE-89) in query parameter filtering — unsanitised user input interpolated into WHERE clause
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: kaycoth
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in sources-api-go. An authenticated remote user can exploit a SQL injection vulnerability by injecting arbitrary SQL expressions through query parameter filtering. This can lead to unauthorized information disclosure of internal database fields, arbitrary PostgreSQL function execution, and denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 18:12:13 UTC 
A SQL injection vulnerability was found in sources-api-go. The applyFilters() function builds GORM Where() clauses by string-formatting the caller-supplied column name into SQL. middleware/filtering.go passes any query-parameter key that is not limit, offset, or sort_by into filter.Name with no sanitisation, allowing arbitrary SQL expressions to be injected into the WHERE clause. The sort_by parameter is also passed to query.Order() via string concatenation.

Any authenticated console.redhat.com user can inject SQL through query parameter filtering, leading to information disclosure of internal database fields and schema details, arbitrary PostgreSQL function execution through the WHERE clause, SQL error details returned in HTTP responses, and denial of service from expensive SQL expressions.

Affected code:
- middleware/filtering.go:63-77 — raw query-param key becomes filter.Name with no sanitisation
- dao/filtering.go:65,80-83 — column name string-concatenated into WHERE clause
- dao/filtering.go:114-117 — sort_by value passed to query.Order() via string concatenation

Confirmed on staging.

Upstream issue: https://redhat.atlassian.net/browse/RHCLOUD-49586