CVE-2026-53448 coturn CVE debrief

Who should care

Administrators and users of Coturn TURN and STUN Server instances should be aware of this vulnerability and take immediate action to update to version 4.12.0 or apply compensating controls. This vulnerability could lead to full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM.

Technical summary

The Coturn HTTPS admin panel is vulnerable to SQL injection due to the direct interpolation of HTTP query parameters into SQL queries without sanitization. Specifically, the delete-user, delete-secret, and delete-IP operations are affected. An authenticated admin can exploit this by injecting arbitrary SQL through the du, ds, and dip parameters, potentially gaining full database control and OS-level access. The vulnerability is fixed in version 4.12.0.

Defensive priority

High

Recommended defensive actions

• Update Coturn to version 4.12.0 or later
• Implement compensating controls such as Web Application Firewalls (WAFs) to detect and prevent SQL injection attacks
• Monitor and audit database activity for suspicious queries
• Restrict access to the admin panel to trusted users and networks
• Regularly review and update Coturn configurations and dependencies
• Perform vulnerability scanning and penetration testing to identify potential SQL injection vulnerabilities
• Implement a Web Application Firewall (WAF) to detect and prevent SQL injection attacks

Evidence notes

The CVE record was published on 2026-07-10T19:17:23.930Z and last modified on 2026-07-10T19:20:15.180Z. The NVD entry is currently Undergoing Analysis. The vulnerability is fixed in version 4.12.0. Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated admin can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM.

Official resources