CVE-2026-34400 is a critical (CVSS 9.8) SQL injection in Alerta, the monitoring tool, through the q search parameter when it runs on Postgres. The fix is version 9.1.0, which uses parameterized queries. The MongoDB backend is not affected. Check which database backend you use.
What's affected
The NVD record says versions before 9.1.0. The project's advisory (GHSA-8prr-286p-4w7j) names the pip package alerta-server and lists 9.1.0 as the fixed version, although its affected range is written as 9.1.0 and below. Treat anything below 9.1.0 as affected and confirm the newest release.
The cause is the Postgres query parser. It built WHERE clauses by putting user search terms straight into SQL strings with f-strings. The advisory says the MongoDB backend was not affected.
How to check if you're exposed
pip show alerta-server
For containers, check the image tag. Then check which database backend you use in the configuration. A MongoDB backend is not affected, a Postgres one is.
Check proxy logs for odd q= values on the alerts API, and note whether the API is exposed beyond your monitoring network.
If the API is public, look at the proxy's logs for q= values that are unusually long or contain quote characters. Odd entries do not prove misuse, but they show where to look in the database logs.
What to do now
- Check the Alerta version and database backend.
- Upgrade to 9.1.0 or later.
- If you cannot upgrade, the advisory suggests a proxy in front of the API that sanitizes the q parameter. Treat that as a stopgap.
- Restrict the API to the networks that need it.
- Review Postgres roles so the Alerta account has only the rights it requires.
Why it matters
The weakness is CWE-89, SQL injection. The fix is the textbook one: pass values as bound parameters instead of building SQL text. The advisory describes %(name)s placeholders handled by the database driver.
Search boxes are a common injection point because they accept free text and feel harmless. A code scan can flag string-built SQL before it ships. The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
A static code scan is a good fit for this bug. String-built SQL has a recognizable shape, and a scanner can flag it in a pull request before the code is merged. The same change in the Postgres parser, from f-strings to bound parameters, is the pattern to look for elsewhere in your own services.
If you cannot upgrade at once, the advisory suggests a proxy that sanitizes the q parameter. Sanitizing by pattern is fragile, so keep it strict, log what it blocks, and plan the upgrade within days, not months. Also check that the database account used by Alerta can read and write only its own tables, so a flaw in one query cannot reach other data in the same server. Add a note to your runbook that search endpoints are in scope for injection testing, since they take free text.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the MongoDB backend affected?
No, per the advisory. Only the Postgres query parser had the problem.
Sources
Last reviewed: 19 October 2026.
