CVE-2026-21892
📋 TL;DR
A SQL injection vulnerability in Parsl's visualization component allows unauthenticated attackers to execute arbitrary SQL commands by manipulating the workflow_id parameter in URLs. This affects all Parsl installations using versions before 2026.01.05 with the parsl-visualize dashboard accessible. Attackers could potentially exfiltrate monitoring data or cause denial of service.
💻 Affected Systems
- Parsl
📦 What is this software?
Parsl by Uchicago
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the monitoring database, data exfiltration, and potential lateral movement to connected systems.
Likely Case
Data exfiltration from the monitoring database and potential denial of service against the visualization component.
If Mitigated
Limited impact if database permissions are restricted and network access is controlled, though SQL injection remains possible.
🎯 Exploit Status
SQL injection via URL parameters is trivial to exploit with standard SQLi techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.01.05
Vendor Advisory: https://github.com/Parsl/parsl/security/advisories/GHSA-f2mf-q878-gh58
Restart Required: Yes
Instructions:
1. Upgrade Parsl to version 2026.01.05 or later
2. Restart all Parsl services
3. Verify the visualization dashboard functions correctly
🔧 Temporary Workarounds
Disable parsl-visualize
allTemporarily disable the vulnerable visualization component
Comment out or remove parsl-visualize from your Parsl configuration
Network Access Control
allRestrict access to the visualization dashboard
Configure firewall rules to limit access to parsl-visualize port (default: 8080)
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Parsl visualization dashboard
- Deploy a web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check if parsl-visualize is accessible and Parsl version is below 2026.01.05Check Version:
python -c "import parsl; print(parsl.__version__)"Verify Fix Applied:
Verify Parsl version is 2026.01.05 or later and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts via visualization dashboard
- SQL syntax errors in application logs
Network Indicators:
- Unusual patterns in requests to /visualize endpoints
- SQL keywords in URL parameters
SIEM Query:
source="parsl.logs" AND ("workflow_id" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE"))