OpenCATS SQL Injection (CVE-2026-49490) Allows Authenticated Database Access

The National Vulnerability Database has disclosed CVE-2026-49490, a high-severity SQL injection vulnerability affecting OpenCATS versions 0.9.1a and later. This flaw is present in the DataGrid filter handling, specifically allowing authenticated attackers to inject SQL through crafted filters. The critical aspect here is that attackers can bypass column filterable restrictions by manipulating filter requests, enabling them to execute arbitrary SQL queries against the underlying database.

This isn’t just a theoretical bypass; it’s a direct path to data exfiltration or manipulation for anyone with valid credentials. The vulnerability leverages the non-filterable ‘Tags’ column in the Candidates DataGrid, turning a seemingly innocuous feature into a critical attack vector. Given the authenticated nature, this threat escalates rapidly if internal accounts are compromised or if attackers gain initial access through other means.

For defenders, this means patching OpenCATS immediately is paramount. An attacker who can authenticate can own your data. This isn’t about complex zero-days; it’s about a fundamental input validation failure that gives a low-privileged attacker high-impact capabilities. Review your OpenCATS instances and ensure all patches are applied to mitigate this risk.