PyPI/alerta-server CVE-2026-34400: unknown, EPSS 0.59%

alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Action: Upgrade alerta-server to 9.1.0 or later.

pip install alerta-server==9.1.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2341
• https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j
• https://nvd.nist.gov/vuln/detail/CVE-2026-34400
• https://github.com/alerta/alerta/pull/2040
• https://github.com/alerta/alerta/pull/712
• https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00
• https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883
• https://github.com/alerta/alerta
• https://github.com/alerta/alerta/releases/tag/v9.1.0
• https://pypi.org/project/alerta-server
• https://github.com/advisories/GHSA-8prr-286p-4w7j

CVE-2026-34400 · published 2026-07-13T14:36:46.380944Z · modified 2026-07-13T16:31:36.295613987Z · JSON