CVE-2026-105412

Executive Summary

CVE-2026-105412 is an SQL Injection vulnerability (CWE-89) affecting Tuleap Enterprise Edition 17.5. A remote attacker with low-privileged authenticated access can exploit the flaw to gain read access to the underlying Tuleap database, potentially exposing user records, project data, credentials, and other sensitive information. The vulnerability carries a CVSS 3.1 base score of 7.1 and, as of this reporting, no public proof-of-concept, exploit code, or vendor patch has been identified.

Technical Analysis

Tuleap is an open-source application lifecycle management (ALM) and project collaboration platform widely deployed in enterprise environments for software development, requirements management, and DevOps workflows. The Enterprise Edition is a commercial distribution that shares the core codebase with the community edition but adds enterprise features.

CVE-2026-105412 is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as SQL Injection). According to the NVD description, the vulnerability allows an attacker to "have read access the Tuleap database." This indicates the injection point permits at minimum a read-oriented SQL primitive — likely UNION-based or error-based extraction, or blind boolean/time-based inference — rather than arbitrary write or stacked query execution. The description does not specify the exact parameter, endpoint, or code component that is vulnerable.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L provides meaningful constraints on the attack model:

• AV:N (Network) — The vulnerable component is reachable over the network, consistent with Tuleap's web-facing architecture. No local or adjacent access is required.
• AC:L (Low) — No unusual conditions, race conditions, or specialized preconditions are required to trigger the injection; the attack can be repeated reliably.
• PR:L (Low privileges) — The attacker must be authenticated with a low-privileged account. This is a critical triage differentiator: unlike pre-authentication SQL injection vulnerabilities, this flaw requires a valid session or at least valid credentials for a low-privilege role. Anonymous exploitation is not indicated by the vector.
• UI:N (No user interaction) — No victim action, such as clicking a link, is required.
• S:U (Unchanged) — The exploit does not cross a security authority boundary; the vulnerable component and the impacted component are the same.
• C:H (High Confidentiality impact) — Consistent with the NVD description of read access to the Tuleap database. The attacker can potentially read substantial portions of application data depending on database account privileges.
• I:N (No Integrity impact) — The vulnerability does not permit modification or deletion of data; the injection is read-only in effect per the advisory.
• A:L (Low Availability impact) — A low availability impact may result from resource exhaustion (e.g., heavy or malformed queries), error-induced degradation, or partial service disruption during exploitation. Full denial of service is not implied.

Because the NVD description is sparse, the specific injection surface cannot be attributed to a named function, controller, route, or parameter without fabricating details. The vulnerability class remains SQL injection against a web-reachable Tuleap component requiring an authenticated low-privilege context. Attackers would probe authenticated functionality — such as search, filtering, reporting, or tracking-system queries — for unsanitized input that is concatenated into SQL statements rather than parameterized. Until a vendor advisory identifies the exact endpoint, defenders should treat all authenticated query-bearing features as potential touchpoints.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-105412. The following attack chain is inferred strictly from the vulnerability class (CWE-89) and the CVSS vector provided. No specific endpoints, parameters, or function names are asserted, because the NVD description does not disclose them.

1. Reconnaissance and target identification. The attacker identifies a reachable Tuleap Enterprise Edition 17.5 deployment, typically via HTTP/HTTPS fingerprinting of the login portal or project pages. Version disclosure, public release notes, or asset inventory data can confirm the affected version. Because exploitation requires PR:L, the attacker must obtain or already possess a low-privileged account — through self-registration if enabled, credential stuffing, phishing, or purchase on criminal markets.

2. Triggering the flaw class. After authenticating with a low-privilege account, the attacker exercises authenticated functionality that constructs SQL queries from user-supplied input. The vulnerability class — SQL injection — is triggered when input is incorporated into a SQL statement without proper parameterization or escaping. The NVD advisory does not identify which input field or feature is affected; the attacker would enumerate candidate inputs (search fields, filter parameters, identifier values, and similar query-driven features) and submit probe strings to observe error behavior or response differences.

3. Payload and execution method (class-level). At the vulnerability-class level, the attacker supplies crafted SQL syntax designed to alter the semantics of the underlying query and cause the database to return data it normally would not. Depending on whether query results are reflected in the response, the attacker may use in-band extraction (for example, union-style or error-based techniques) or inferential techniques (boolean-based or time-based) if output is not directly visible. The advisory constrains the outcome to read access, suggesting extraction-oriented payloads rather than writes, stacked statements, or command execution. The database account privileges associated with the Tuleap application determine the ceiling of what can be read; application accounts are frequently over-privileged relative to what the application strictly requires.

4. Post-exploitation impact. Successful exploitation yields read access to the Tuleap database. Depending on schema contents, this can expose user account records (including password hashes), email addresses, project and artifact data, permission configurations, integration secrets, and potentially session or token material. Exfiltrated password hashes can be cracked offline or reused where password hygiene is poor, and harvested secrets can enable lateral movement into connected systems (source control, CI/CD, or identity providers integrated with Tuleap). The low availability subscore indicates the attacker may also degrade service quality through abusive query patterns, though destructive intent is not implied by the vector.

Impact Assessment

CVE-2026-105412 affects Tuleap Enterprise Edition 17.5. Impact is rated High for confidentiality, None for integrity, and Low for availability, producing a CVSS 3.1 base score of 7.1 (High severity). The PR:L precondition moderately narrows the exposed population to deployments where an attacker can obtain any authenticated low-privilege account; in environments with open self-registration or weak onboarding controls, that barrier is low.

Business impact centers on data exposure. Tuleap frequently serves as the system of record for software requirements, test plans, release artifacts, and issue tracking — content that can reveal product roadmaps, security defects, customer commitments, and internal architecture. The user table is a high-value target: password hash extraction enables offline cracking and credential reuse attacks against VPN, SSO, and email systems, particularly where password reuse is common. Integration credentials stored in the database can extend the blast radius beyond Tuleap itself into source repositories, artifact stores, and CI/CD pipelines.

The blast radius is bounded by the database account permissions used by the Tuleap application. A least-privilege database configuration limits exposure to the tables the application account can read; an over-privileged account exposes the full schema. Because the flaw does not provide write or execute primitives per the advisory, direct data destruction and operating-system-level compromise are not indicated by the vector — but the confidentiality loss alone supports treating this as a priority-1 or priority-2 remediation for affected deployments. The low availability subscore warrants monitoring for service degradation during exploitation attempts.

Detection Guidance

Sigma Rule

title: Tuleap SQL Injection Exploitation Attempt (CVE-2026-105412)
id: 8f4c2b91-7d3a-4e6f-b2c8-1a9e5d0f3b47
status: experimental
description: Detects SQL injection payload patterns in HTTP requests targeting Tuleap Enterprise Edition 17.5
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105412
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026.105412
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_sqli:
    cs-uri-query|contains:
      - "' OR "
      - "' OR '1'='1"
      - "UNION SELECT"
      - "union select"
      - "SLEEP("
      - "BENCHMARK("
      - "information_schema"
      - "CONCAT("
      - "' AND "
      - "-- "
      - "/*"
      - "WAITFOR DELAY"
  filter_health:
    cs-uri-query|contains:
      - "healthcheck"
      - "status=pong"
  condition: selection_method and selection_sqli and not filter_health
falsepositives:
  - Legitimate query strings containing SQL keywords in documentation links
  - Application security scanners in authorized testing
level: high

YARA Rule

rule CVE_2026_105412_Tuleap_SQLi
{
    meta:
        description = "Detects SQL injection tooling and payload artifacts targeting Tuleap Enterprise Edition (CVE-2026-105412)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105412"
        severity = "high"

    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "' OR '1'='1" nocase
        $sqli3 = "information_schema" nocase
        $sqli4 = "SLEEP(" nocase
        $sqli5 = "BENCHMARK(" nocase
        $sqli6 = "WAITFOR DELAY" nocase
        $tuleap1 = "tuleap" nocase
        $tuleap2 = "Tuleap" nocase
        $sqlmap = "sqlmap" nocase
        $payload_marker = "sql injection" nocase

    condition:
        (2 of ($sqli*)) and (1 of ($tuleap*) or 1 of ($sqlmap, $payload_marker))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105412 Tuleap Enterprise SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.method; content:"POST"; http.uri; content:"Tuleap"; nocase; http.uri; pcre:"/(\x27|\%27).*(OR|AND).*(\=|\x22|LIKE)/i"; http.uri; content:"UNION SELECT"; nocase; http.uri; content:"information_schema"; nocase; http.uri; content:"SLEEP("; nocase; http.uri; content:"BENCHMARK("; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:web-application-attack; sid:2026105412; rev:1; metadata:cve CVE-2026-105412;)

alert http any any -> any any (msg:"CVE-2026-105412 Tuleap Blind SQLi Time-Based Probe"; flow:established,to_server; http.uri; pcre:"/(SLEEP|BENCHMARK|WAITFOR\s+DELAY|PG_SLEEP)\s*\(/i"; classtype:web-application-attack; sid:2026105413; rev:1; metadata:cve CVE-2026-105412;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [http where http.request.method in ("GET", "POST") and
    wildcard(http.request.uri.query, "*UNION SELECT*") and
    wildcard(url.path, "*Tuleap*")]
  [http where http.request.method in ("GET", "POST") and
    (wildcard(http.request.uri.query, "*information_schema*") or
     wildcard(http.request.uri.query, "*SLEEP(*") or
     wildcard(http.request.uri.query, "*' OR *"))]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache:access
| eval uri=lower(uri)
| where (match(uri, "union[ %\+]+select") OR match(uri, "information_schema") OR match(uri, "sleep\(") OR match(uri, "benchmark\(") OR match(uri, "waitfor[ %\+]+delay") OR match(uri, "%27[ %\+]*(or|and)[ %\+]*"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as request_uris by src_ip, status
| where count >= 3
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
| table src_ip, count, status, first_seen, last_seen, request_uris

Wazuh OSSEC Rule

<group name="web,appsec,sqli,cve-2026-105412">
  <rule id="105412" level="12">
    <if_sid>31100</if_sid>
    <id>^40[0-9]$|^50[0-9]$</id>
    <url>UNION|union|information_schema|SLEEP\(|BENCHMARK\(|WAITFOR|%27</url>
    <description>CVE-2026-105412: Possible SQL injection attempt against Tuleap Enterprise Edition</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sqli_attempt,</group>
  </rule>

  <rule id="105413" level="13" frequency="5" timeframe="120">
    <if_matched_sid>105412</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-105412: Repeated SQL injection attempts from same source - active exploitation likely</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sqli_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround has been published in the tracked intelligence as of this report. The guidance below is operational and conservative.

1. Immediate mitigations.

   • Restrict network exposure: place Tuleap Enterprise Edition 17.5 behind a VPN or identity-aware proxy so only trusted networks reach the application, reducing the reachable attack surface for AV:N exploitation.
   • Enforce least privilege on the database account used by the Tuleap application. If the application account currently has broad read or DDL rights, reduce it to the minimum set of tables and operations required for normal operation, capping the potential read exposure described in the advisory.
   • Harden authentication: disable open self-registration if it is enabled, enforce MFA and strong password policy on all accounts, and audit existing low-privilege accounts for signs of compromise or abuse. The PR:L precondition means the attacker needs a valid low-privilege identity.
   • Deploy the detection rules in this report at the web server, WAF, and SIEM layers. A web application firewall with SQL injection signatures in blocking mode can provide interim virtual patching for known payload patterns, though it does not address the root cause.
   • Monitor for service degradation consistent with the CVSS availability subscore (A:L), such as elevated response times or error rates on authenticated query features.

2. Patch/upgrade steps.

   • Monitor the Tuleap vendor security advisories and release notes continuously for a version that addresses CVE-2026-105412. No fixed version has been identified in tracked sources.
   • When a fix becomes available, schedule an emergency upgrade of Tuleap Enterprise Edition from 17.5 to the first patched release. Validate in a staging environment first, then apply during a maintenance window with full backups of the application database.
   • If a vendor-provided workaround or configuration hardening step is published, apply it immediately as a stopgap while planning the upgrade.

3. Long-term hardening.

   • Adopt a vulnerability management process that tracks Tuleap security advisories and correlates them with deployed versions; maintain an asset inventory that identifies Tuleap instances and their exact editions and versions.
   • Enforce parameterized queries and secure coding review across any custom or in-house development that interacts with Tuleap's data layer, treating CWE-89 as a systemic risk rather than an isolated defect.
   • Rotate credentials and secrets stored in or accessible through the Tuleap database (integration tokens, API keys, service accounts) as a precaution, and segregate those secrets into a dedicated secret manager where feasible.
   • Segment the Tuleap database so that a compromised application account cannot pivot to unrelated systems, and enforce database activity monitoring for anomalous read volumes from the Tuleap application account.

References

• NVD — CVE-2026-105412: https://nvd.nist.gov/vuln/detail/CVE-2026-105412
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• FIRST EPSS — not yet scored for this CVE at time of reporting: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-105412 not listed (no exploit-in-the-wild evidence in tracked sources): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Tuleap Security Advisories / release notes — monitor for CVE-2026-105412 remediation: https://tuleap.org/security/

No public proof-of-concept, exploit code, Nuclei template, or evidence of active exploitation campaigns was identified in the intelligence provided for CVE-2026-105412. The attack chain described in this report is inferred from the assigned vulnerability class (CWE-89) and the CVSS vector; it does not rely on any unverified implementation specifics.