PyPI/alerta-server CVE-2026-34400: critical 9.8, EPSS 0.53%

alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Action: Upgrade alerta-server to 9.1.0 or later.

pip install alerta-server==9.1.0

Affected

Fixed versions

Sources

• osv: GHSA-8prr-286p-4w7j
• nvd: CVE-2026-34400
• https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j
• https://github.com/alerta/alerta/pull/2040
• https://github.com/alerta/alerta/pull/712
• https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00
• https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883
• https://github.com/alerta/alerta
• https://github.com/alerta/alerta/releases/tag/v9.1.0

CVE-2026-34400 · published 2026-03-31T23:23:21Z · modified 2026-07-13T16:43:01.668638302Z · JSON