CVE-2026-33058CVSS 9.8CRITICAL
The severity of CVE-2026-33058 is rated as CRITICAL due to its high impact and the ease with which it can be exploited by authenticated users. The vulnerability is exploitable in both homelab and production environments, especially where default configurations are used. Patches have been released but require thorough testing before deployment due to potential compatibility issues. The window of exposure for unpatched systems is significant until remediation steps are fully implemented.

CVE-2026-33058 identifies a critical authenticated SQL injection vulnerability in Kanboard, an open-source project management tool. This flaw allows attackers with valid credentials to execute arbitrary SQL commands on the backend database, potentially leading to data exfiltration or even complete system compromise. Affected versions of Kanboard are highly susceptible because they improperly sanitize user input before executing it within database queries. The vulnerability is particularly dangerous in environments where Kanboard interacts directly with sensitive databases or shares its environment with other critical applications. Engineers and sysadmins must take immediate action to mitigate this risk, as the potential for data breaches and system compromise is significant.

Affected Systems
  • Kanboard versions prior to 1.2.30
Affected Versions: all versions before 1.2.30
Remediation
  • Upgrade Kanboard to version 1.2.30 or later using the command: `git pull` followed by `composer install` in the project root directory.
  • Review and sanitize all recent database queries for potential injection points, focusing on user input fields such as task descriptions and comments.
  • Implement a WAF rule to block SQL injection attempts targeting Kanboard's endpoints. Example configuration: `SecRule ARGS "sql_injection" "id:123456,deny,status:403,msg:'SQL Injection Detected'"`
Stack Impact

This vulnerability can have a significant impact on common homelab stacks running Kanboard version 1.2.29 or earlier, especially those using MySQL databases and default configurations. The `kanboard.conf.php` file may need to be updated with new security rules, such as enabling strict mode in the database connection settings.

Source →