CVE-2026-25076 HIGH

CVE-2026-25076: Anchore Enterprise GraphQL Reports API SQL injection

Vendor Anchore
Product Anchore Enterprise
Weakness CWE-89 · SQLi
Published March 12, 2026
Last update March 13, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQL instructions resulting in modifications to the data contained in the Anchore Enterprise database.

Key dates

02Disclosure timeline

March 12, 2026 CVE published
March 13, 2026 Record updated