CVE-2025-26392
📋 TL;DR
SolarWinds Observability Self-Hosted contains a SQL injection vulnerability that allows authenticated low-privilege users to extract sensitive data from the database. This affects organizations running vulnerable versions of SolarWinds Observability Self-Hosted. Attackers need valid low-level credentials to exploit this vulnerability.
💻 Affected Systems
- SolarWinds Observability Self-Hosted
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with low-privilege credentials could extract sensitive database information including credentials, configuration data, or monitoring data, potentially leading to further system compromise.
Likely Case
An authenticated user could extract limited sensitive data from the database, potentially exposing configuration details or monitoring information.
If Mitigated
With proper access controls and monitoring, exploitation would be detected and limited to authorized low-privilege users with legitimate access.
🎯 Exploit Status
Exploitation requires authenticated access with low-privilege credentials. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.4 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26392
Restart Required: No
Instructions:
1. Download SolarWinds Observability Self-Hosted version 2025.4 or later from SolarWinds customer portal. 2. Follow standard upgrade procedures for your deployment. 3. Verify successful upgrade and test functionality.
🔧 Temporary Workarounds
Restrict Low-Privilege Account Access
allTemporarily restrict or disable low-privilege accounts until patching can be completed.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SolarWinds Observability systems from sensitive networks.
- Enhance monitoring of database queries from low-privilege accounts and implement alerting for suspicious SQL patterns.
🔍 How to Verify
Check if Vulnerable:
Check current version in SolarWinds Observability Self-Hosted web interface under Help > About. If version is earlier than 2025.4, system is vulnerable.Check Version:
Check web interface at Help > About or consult SolarWinds documentation for CLI version check commands specific to your deployment.Verify Fix Applied:
After upgrading, verify version shows 2025.4 or later in Help > About. Test functionality to ensure no regression issues.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns from low-privilege accounts
- Multiple failed SQL injection attempts in application logs
- Unexpected database access from application accounts
Network Indicators:
- Unusual database query patterns from application servers
- Multiple similar SQL requests in short timeframes
SIEM Query:
source="solarwinds-observability" AND (sql_injection OR sql_error OR "sql syntax") AND user="low_privilege_account"