CVE-2026-57230mediumCWE-89

CVE-2026-57230: medium-severity vulnerability in openreplay

OpenReplay: Authenticated ClickHouse SQL injection via session search

Published · Updated

Follow this CVE+ Monitor openreplay

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.3%
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L
Affected products
openreplay · openreplay
Related CVEs — openreplay

In the same product, most dangerous first.

CVE-2023-48226MEDIUMOpenReplay HTML Injection vulnerabilityEPSS 0.8%CVE-2026-55879CRITICALOpenReplay: Unauthenticated stored XSS leads to dashboard account takeoverEPSS 0.5%CVE-2026-55881HIGHOpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpointEPSS 0.4%CVE-2026-28443MEDIUMOpenReplay: SQL injection in cards/search via unvalidated sort field parameterEPSS 0.4%CVE-2026-55880HIGHOpenReplay: Cross-user IDOR in notes and dashboard widgetsEPSS 0.3%CVE-2026-45296HIGHOpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant bindingEPSS 0.2%