PatchSiren

chirpstack CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM chirpstack CVE published 2026-08-05

CVE-2026-71282

An authenticated user with device-list access can inject SQL via a crafted tag key when the SQLite backend (chirpstack-sqlite package) is in use. This vulnerability arises from the direct interpolation of user-supplied tag keys into raw SQL fragments in the ChirpStack's SQLite-backend device tag filtering, specifically in the get_count() and list() functions in chirpstack/src/storage/device.rs. Only the t [truncated]