CVE-2026-108474: JetBrains Exposed SQL Injection
TL;DR - CVE-2026-108474 affects JetBrains Exposed versions before 1.5.1 through unescaped string arguments in several SQL functions. - Applications using affected APIs with attacker-controlled input may be at risk. Upgrade to 1.5.1 or later. - No confirmed in-the-wild exploitation or public proof of concept was identified in the supplied records, but the reported CVSS score is 9.8.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-108474 |
| Product | JetBrains Exposed |
| CVSS | 9.8, critical |
| CVSS vector | Not included in the supplied NVD record |
| Attack vector | Unknown from the supplied record; practical exposure depends on whether application paths reach the affected APIs |
| Authentication required | Unknown because the CVSS vector was not supplied |
| Affected versions | JetBrains Exposed versions before 1.5.1 |
| Fixed version | 1.5.1 |
| Patch available | Yes |
| CISA KEV status | Not listed |
CVE-2026-108474 is a dependency-level vulnerability. The presence of the vulnerable library does not automatically mean every application using Exposed is exploitable. Risk depends on whether application-controlled or otherwise untrusted strings reach the affected SQL functions and whether an attacker can reach the resulting database operation.
The supplied NVD record reports a CVSS base score of 9.8, but it does not include the vector string. The exact network, authentication, privilege, scope, confidentiality, integrity, and availability metrics therefore cannot be asserted from the available data. Treat the issue as high priority while validating application-specific reachability.
What Is CVE-2026-108474?
The root cause is the use of unescaped string arguments in several SQL functions within JetBrains Exposed versions before 1.5.1. When a string supplied to one of these functions can be influenced by an attacker, Exposed may incorporate that value into generated SQL without adequate escaping or safe parameter handling.
This creates a SQL injection condition. Depending on the affected function, database engine, query context, database account permissions, and application behavior, an attacker could potentially alter query logic, access data, modify records, or interfere with database availability.
The supplied material does not identify the exact functions or affected Exposed modules. Defenders should therefore inventory all Exposed SQL-function usage rather than assume that only one API is relevant.
The vulnerability is in the query-construction path, not necessarily in an application’s HTTP layer. An application may have conventional request validation and still be exposed if an untrusted value is later passed to a vulnerable Exposed function. Review values originating from web requests, API payloads, message queues, imported files, tenant configuration, and administrative interfaces.
Who Is Affected?
The affected product is JetBrains Exposed, specifically versions before 1.5.1. The fixed version is 1.5.1. The supplied NVD information does not provide more granular lower and upper bounds, affected modules, or a list of exact SQL functions. Organizations should therefore treat every Exposed version earlier than 1.5.1 as potentially affected until the dependency inventory and vendor advisory establish otherwise.
Applications are most exposed when they use Exposed SQL functions that accept string arguments and pass externally controlled data into those arguments. Internet-facing services, multi-tenant applications, database-backed APIs, and systems that expose filtering or sorting expressions deserve immediate review.
Internal applications should not be dismissed. Compromised users, malicious tenants, or untrusted integrations may still provide the relevant input. Teams reviewing authentication and administrative access can also consult this bearer token security glossary for related access-control terminology.
A dependency scan should identify both direct and transitive use of Exposed. Check deployed artifacts rather than relying only on source manifests; shaded, cached, or containerized dependencies can leave an older library in production after a source-level update.
CVSS Score Breakdown
CVE-2026-108474 has a reported CVSS base score of 9.8, classified as critical. The supplied NVD response did not include the CVSS vector string. Without that vector, the individual metric values cannot be responsibly reconstructed, including whether the assessed attack vector was network-based, whether authentication was required, and whether user interaction was considered necessary.
The 9.8 score indicates severe assessed impact and exploitability under the scoring model used by the record. It should influence prioritization, but it is not a substitute for application testing. A vulnerable library used only with constant, trusted query strings presents a different practical risk from one used to process unauthenticated tenant input.
Security teams should retrieve the authoritative NVD record and vendor advisory before incorporating individual CVSS metrics into formal risk reports. Until then, record the score as 9.8 and mark vector-level fields as unavailable rather than filling them with assumptions.
Analyst’s Take: The first practical question is not whether Exposed appears somewhere in the dependency tree, but whether untrusted strings can reach its SQL-function arguments. Upgrade to 1.5.1 or later, then use code, artifact, and application-path review to distinguish a present dependency from an exposed query path.
Exploitation Status
The supplied records do not establish confirmed exploitation in the wild. CVE-2026-108474 is not listed in the CISA Known Exploited Vulnerabilities catalog, and no CISA exploitation date, due date, required action, or ransomware flag was reported.
No public proof-of-concept repository or exploit reference was present in the supplied NVD data. The current evidence supports the following status:
- Confirmed exploitation: Not established
- Public proof of concept: Not identified in the supplied sources
- CISA KEV listing: No
These findings are time-sensitive and should be rechecked against NVD, the JetBrains advisory, threat-intelligence feeds, and relevant code-hosting activity.
Absence from KEV or absence of a known proof of concept does not prove that exploitation has not occurred. SQL injection can be practical without a polished public exploit when an attacker understands the application’s request format and database behavior. Prioritize exposed applications and monitor them while remediation is underway.
How to Detect CVE-2026-108474
Start with software inventory. Search dependency manifests, lockfiles, container build files, and deployed application images for JetBrains Exposed versions below 1.5.1. Map the library usage to request handlers, API endpoints, background jobs, and administrative functions that accept untrusted values.
Application and database logs may show database errors caused by malformed or altered query input. A generic review pattern includes repeated SQL errors associated with unusual quote characters, comment markers, unexpected Boolean expressions, or requests that produce abnormal changes in query length.
These indicators are not proof of exploitation, and normal application behavior can produce similar errors.
Technical Detection Notes
A basic source and artifact review can begin with commands such as:
# Search common dependency and build files for Exposed references
grep -RniE 'exposed|jetbrains.*exposed' \
--include='build.gradle' \
--include='build.gradle.kts' \
--include='pom.xml' \
--include='gradle.lockfile' \
--include='libs.versions.toml' .
# Inspect a built JAR or application directory for Exposed metadata
find . -type f \( -name '*.jar' -o -name '*.war' \) -print0 |
xargs -0 -n1 sh -c 'jar tf "$0" 2>/dev/null | grep -q "org/jetbrains/exposed" && echo "$0"'
For centralized logging, a starting query should search for SQL error indicators near requests handled by affected services. Field names vary by platform, so adapt the example to the deployed log schema:
service:("api" OR "web") AND
(message:"SQL" OR message:"database") AND
(message:"syntax error" OR
message:"unterminated" OR
message:"quoted string" OR
message:"unexpected token")
Database audit logs should also be reviewed for:
- Abnormal query volume
- Unexpected access to sensitive tables
- Queries issued by application accounts outside normal endpoints
- Failed statements followed by successful statements with unusual result sizes
Do not rely on a single signature. SQL injection may produce no obvious error when the injected expression is syntactically valid.
Mitigation and Patching
Upgrade JetBrains Exposed to 1.5.1 or later. The affected range is every version before 1.5.1, and 1.5.1 is the specific fixed version identified in the supplied advisory information.
After changing the dependency:
- Rebuild the application.
- Inspect the resolved dependency graph.
- Redeploy all relevant services.
- Confirm that no older copy remains in a container or application bundle.
- Test representative database queries in a non-production environment.
- Validate the production artifact and dependency lockfile.
Review application code that uses Exposed SQL functions with string arguments. Remove unnecessary dynamic SQL construction, ensure externally controlled values are handled through safe parameterized mechanisms supported by the application and library, and apply strict allowlists for structural values such as column names, sort directions, or operators.
Escaping alone should not be treated as a complete substitute for safe query construction.
Technical Patching Notes
If the project defines an exposedVersion property, an upgrade and verification sequence may look like this:
# Use only when the project already supports this property
./gradlew build -PexposedVersion=1.5.1
# Confirm the resolved Exposed version in the dependency graph
./gradlew dependencies --configuration runtimeClasspath |
grep -i -A2 -B2 exposed
For Maven projects, update the Exposed dependency version in the project’s dependency management or properties section to 1.5.1, then run:
mvn clean verify
mvn dependency:tree | grep -i exposed
The exact artifact coordinates and project property names must come from the application’s existing build files. Do not add an unverified module solely because its name appears in a scan.
If an immediate upgrade is impossible:
- Prevent untrusted input from reaching affected SQL-function string arguments.
- Disable nonessential endpoints that construct dynamic SQL.
- Restrict database credentials to the minimum required permissions.
- Place affected services behind appropriate access controls.
- Increase monitoring of application and database activity.
These are temporary risk-reduction measures, not replacements for upgrading.
After deployment, test representative queries and review generated SQL behavior in a non-production environment. Confirm that application functionality remains intact, then validate the production artifact and dependency lockfile against version 1.5.1 or later.
For endpoint monitoring during remediation, organizations may also consider a reputable security product such as Get Bitdefender →, provided it fits the environment’s existing detection and response strategy.
Incident-Response Considerations
If logs indicate that suspicious input reached a vulnerable query path, preserve relevant application, database, proxy, and identity logs before making changes that could overwrite evidence. Identify the affected service, database account, request source, time range, accessed tables, and any changes made during the suspected activity.
Rotate credentials if database-account exposure is possible, but coordinate rotation with evidence preservation and application availability requirements. Review database permissions and investigate whether the application account could read or modify data beyond its intended function.
Organizations should also document whether the vulnerable dependency was present in source code, build artifacts, deployed images, or production services. This distinction helps determine the actual exposure window and supports later remediation verification.
References
The authoritative NVD record is the primary source for the published CVE description and reported CVSS score:
JetBrains’ fixed-security-issues page should be checked for vendor-specific details, affected functions, and implementation guidance:
Use the CISA catalog to verify whether exploitation status changes:
The supplied record identifies the CVE as published and modified on October 10, 2026. The supplied data does not include the CVSS vector, exact vulnerable SQL functions, detailed module boundaries, an EPSS value, or a public exploit reference. Those fields should be refreshed from authoritative sources before making a final risk decision.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.