CVE-2026-26198: Collerek Ormar SQL injection (CVSS 9.8)

Description

Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()` skip this validation entirely. As a result, an attacker-controlled string is embedded as raw SQL inside the aggregate function call. Any unauthorized user can exploit this vulnerability to read the entire database contents, including tables unrelated to the queried model, by injecting a subquery as the column parameter. Version 0.23.0 contains a patch.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Collerek Ormar≥ 0.9.9 < 0.23.0

Remediation

Fixed in

Collerek Ormar≥ 0.23.0

Patch & vendor advisories

References

https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16Patch
https://github.com/collerek/ormar/releases/tag/0.23.0ProductRelease Notes
https://github.com/collerek/ormar/security/advisories/GHSA-xxh2-68g9-8jqrExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-26198 being actively exploited?

CVE-2026-26198 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.69%.

How severe is CVE-2026-26198?

CVE-2026-26198 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.69% probability of exploitation.

Which products are affected by CVE-2026-26198?

Affected products include Collerek Ormar.

How do I fix CVE-2026-26198?

Upgrade affected software to a fixed version, for example Collerek Ormar 0.23.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-26198 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo