CVE-2026-25076CWE-89

Anchore Enterprise GraphQL Reports API SQL injection

High · published March 12, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQL instructions resulting in modifications to the data contained in the Anchore Enterprise database.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-12T21:07Z
EPSS history
Timeline
  • 12 MAR 21:07Z
    Anchore Enterprise GraphQL Reports API SQL injection
    cvelistv5