CVE-2026-28438 MEDIUM

CVE-2026-28438: CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

Vendor Cocoindex-Io
Product cocoindex
Weakness CWE-89 · SQLi
Published March 6, 2026
Last update March 6, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Key dates

02Disclosure timeline

March 6, 2026 CVE published
March 6, 2026 Record updated