The Magistrala (formerly Mainflux) message-readers API vulnerability allows SQL injection via direct interpolation of the 'format' value from the HTTP query string into raw SQL queries in both PostgreSQL and TimescaleDB readers. This enables authenticated users querying channel messages to potentially inject SQL, leading to unauthorized data access or modifications. The CVE record was published on 2026-08 [truncated]
Authenticated low-privileged users can create rules with embedded Go or Lua scripts, potentially leading to arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices due to limited validation in the Go script engine and no input validation in the Lua script engine. This vulnerability exists in Magistrala's Rules Engine, allowing users to execute scri [truncated]
