CVE-2026-75513

Executive Summary

CVE-2026-75513 is a SQL injection vulnerability (CWE-89) in Marten, a .NET Transactional Document DB and Event Store built on PostgreSQL, affecting versions 7.0.0 through 9.12.x and fixed in 9.13.0. The flaw stems from multiple LINQ and tenant-management code paths that interpolate runtime, potentially attacker-controlled strings directly into single-quoted SQL literals without escaping or parameterization, allowing a crafted single quote to break out of the generated literal. Because the affected query paths underpin filter logic and multi-tenant authorization boundaries, successful exploitation enables filter bypass, cross-tenant authorization bypass, and blind data exfiltration; environments that permit semicolon-batched Npgsql statements may additionally allow data modification. The CVSS score of 9.1 (Critical) and the network-accessible, low-privilege attack vector make this a priority remediation item for any team running affected Marten deployments.

Technical Analysis

Marten is a .NET document database and event store abstraction layered over PostgreSQL. Applications interact with it primarily through LINQ query expressions and an IEventStore interface; Marten translates these expressions into SQL executed against PostgreSQL via the Npgsql provider. The vulnerability described in the advisory concerns the SQL-generation layer rather than PostgreSQL itself.

The root cause is a class of unsafe string construction: instead of using parameterized queries or properly escaped literals, several Marten query-building paths interpolate runtime strings directly into single-quoted SQL literals. When an attacker can influence such a runtime string — most importantly a dictionary indexer key used inside a Where filter — a single-quote character embedded in the value terminates the SQL literal early. Everything following the quote is then parsed as SQL syntax rather than treated as data. This is the classic SQL injection pattern, here manifesting inside an ORM's LINQ translation layer.

The advisory identifies the primary confirmed vector as a dictionary indexer key used by Where filters, located in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. In LINQ, dictionary access is written as dict[key]; Marten translates that member access into a SQL expression. If the key value is interpolated into a quoted literal rather than bound as a parameter, an attacker-supplied key becomes an injection point.

Several additional sinks are named in the advisory:

• SelectParser.cs — the parser responsible for projecting/selecting fields during LINQ-to-SQL translation.
• DatabaseScopedTenantPartitions.cs — tenant-partition management logic.
• DeleteAllForTenant.cs — tenant deletion logic, reachable via IEventStore.DeleteProjectionProgressAsync.
• DictionaryContainsKeyFilter.cs — handles ContainsKey calls, but only when the Newtonsoft serializer is in use. The advisory explicitly notes that System.Text.Json is not affected through this sink.
• Events/Daemon/Internals/EventLoader.cs — contains a related per-tenant partition-pruning literal; the advisory characterizes this as a defense-in-depth sink rather than a primary confirmed vector.

The presence of tenant-scoped sinks (DatabaseScopedTenantPartitions.cs, DeleteAllForTenant.cs, and the partition-pruning literal in EventLoader.cs) is significant. Multi-tenant data isolation in Marten is frequently enforced by injecting tenant identifiers into the SQL predicate. If an attacker can influence a tenant identifier that is interpolated rather than parameterized, the isolation boundary itself becomes injectable — this is why the CVSS vector carries S:C (Scope: Changed), reflecting that a compromise in one tenant's query context can impact resources beyond the originally authorized scope.

On impact dimensions, the vector encodes C:H (high confidentiality impact — blind data exfiltration across tenant boundaries), with I:L and A:L reflecting that integrity and availability effects are conditional. The advisory notes that data modification becomes possible specifically where deployments permit semicolon-batched Npgsql statements — i.e., stacking an additional SQL statement after the injected break-out. Where statement batching is disabled by the Npgsql connection configuration, the injection is primarily an inference/exfiltration channel (boolean- or error-based blind SQLi). Availability impact (A:L) is likewise tied to the same batching precondition.

The CVSS attack vector is AV:N/AC:L/PR:L/UI:N — network reachable, low complexity, requiring low privileges, and no user interaction. The low-privilege requirement reflects that the attacker must be able to supply input that reaches a Marten LINQ query or IEventStore call, which in most deployments corresponds to an authenticated application user (though in applications that expose filter parameters pre-authentication, the effective privilege requirement may be lower). The S:C scope change is the element that pushes the base score to Critical territory.

No public proof-of-concept, exploit code, or Nuclei template was available at the time of this report. The advisory is vendor-published (fixed in 9.13.0), but no patch artifacts were detected by tracked sources, and no workarounds were provided in the data available to this report. All technical claims above are derived strictly from the NVD description and the named source files; no additional implementation detail is inferred or invented.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-89 SQL injection via unescaped literal interpolation) and the specific sinks named in the advisory.

1) Reconnaissance / target identification. An attacker identifies an application built on Marten 7.0.0–9.12.x. Fingerprinting can leverage response behaviors common to .NET/PostgreSQL stacks (e.g., Npgsql error surfaces, Marten-specific exception text) and Shodan queries for exposed Marten-backed services. The attacker then maps an application feature that causes user-supplied strings to flow into a Marten LINQ Where filter — most promisingly, a filter whose predicate uses a dictionary indexer key, since DictionaryItemMember.cs is the primary confirmed sink. Applications that expose dictionary-keyed filters (e.g., filtering documents by a dynamic attribute name or key) are the highest-value targets. Additionally, any application that lets a user influence a tenant identifier used in Marten's tenant-partitioned queries is a candidate, given the tenant-management sinks.

2) Triggering the flaw. The attacker submits a value containing a single quote (') through the input that reaches the dictionary indexer key or another affected sink. In DictionaryItemMember.cs, the Where filter translation interpolates that key into a single-quoted SQL literal without escaping. The quote terminates the literal, and the remainder of the attacker's input is interpreted as SQL. For ContainsKey calls routed through DictionaryContainsKeyFilter.cs, the same trigger applies — but only on deployments using the Newtonsoft serializer; System.Text.Json deployments are not affected through that sink. For tenant-scoped sinks (DatabaseScopedTenantPartitions.cs, DeleteAllForTenant.cs reached via IEventStore.DeleteProjectionProgressAsync, and the EventLoader.cs partition-pruning literal), a crafted tenant-value input would be the injection vector.

3) Payload / execution at the vulnerability-class level. Payload construction follows standard SQL injection methodology. Starting from the break-out quote, the attacker appends SQL that evaluates to true/false for boolean-based blind inference, or injects a syntactically invalid fragment to elicit error messages for error-based inference. Because confidentiality impact is high and no public exploit exists, blind data exfiltration — using conditional predicates to infer document contents, tenant identifiers, or cross-tenant records one bit at a time — is the most plausible confirmed impact. The advisory notes that a crafted single quote can "escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration." Where the PostgreSQL/Npgsql connection permits semicolon-batched statements, the attacker can stack an additional statement after the break-out to perform data modification (integrity impact). Where batching is disabled, the attacker is limited to the inference/exfiltration channel.

4) Post-exploitation impact. Successful exploitation yields: (a) filter bypass — query predicates that were supposed to restrict results are neutralized, exposing records the attacker should not see; (b) multi-tenant authorization bypass — tenant-scoped sinks allow crossing tenant boundaries, reading other tenants' documents and event streams; (c) blind data exfiltration of confidential document/event-store contents; and (d) in batching-enabled environments, data modification via stacked statements. Because Marten is frequently the primary data persistence layer for .NET applications, the confidential data exposed may include business-critical and personally identifiable information.

Impact Assessment

CVE-2026-75513 carries a CVSS base score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. Each subscore matters:

• AV:N (network) — the vulnerable query paths are exercisable remotely through the application's normal network-facing interfaces.
• AC:L (low complexity) — no special conditions or race windows are required; a well-formed input containing a single quote is sufficient to begin probing.
• PR:L (low privileges) — the attacker needs a low-privileged foothold capable of supplying input that reaches a Marten query. In many deployments this is any authenticated user; in applications with pre-auth filter endpoints, the practical bar is lower.
• UI:N (no user interaction) — no victim interaction is required.
• S:C (scope changed) — the most consequential subscore. Compromise of one query or tenant context can impact resources outside the authorized scope, reflecting the cross-tenant authorization-bypass dimension of the tenant-management sinks.
• C:H (high confidentiality) — the confirmed impact is blind data exfiltration, potentially across tenant boundaries.
• I:L / A:L — integrity and availability impacts are limited/conditional, primarily realized when the deployment permits semicolon-batched Npgsql statements.

Blast radius. Any organization running Marten 7.0.0 through 9.12.x in production is affected. The affected surface is broad because Marten underpins document storage, event sourcing, and multi-tenant projection/daemon workloads in the same application. Mission-critical .NET applications that store customer data, financial records, or health information in Marten-backed PostgreSQL databases face high confidentiality risk. Multi-tenant SaaS platforms built on Marten's tenant-partitioning feature face the most severe exposure, since cross-tenant isolation — a core contractual and regulatory obligation — is directly undermined.

Business impact. Consequences include unauthorized disclosure of regulated data (potentially triggering GDPR, HIPAA, or PCI DSS notification obligations), loss of customer trust in multi-tenant platforms, and — in batching-enabled environments — possible data integrity compromise. The absence of a public PoC and the critical severity together indicate a window in which defenders should prioritize remediation before exploitation tooling emerges. No exploitation-in-the-wild evidence exists in the data provided; CISA KEV listing is NO, and no threat-actor campaign is attributed.

Detection Guidance

Detection for this vulnerability must combine application-layer observation (SQL query anomalies emitted by Marten) with network and database telemetry. Because Marten constructs SQL on the application server and forwards it to PostgreSQL via Npgsql, the most reliable detection point is either (a) the generated SQL itself, if logged, or (b) the PostgreSQL server's query log and error log.

Sigma Rule

title: Marten LINQ SQL Injection Attempt via Single-Quote Injection (CVE-2026-75513)
id: 8f3c1a2e-6b4d-4e9a-9c7f-2d5e8a1b3c40
status: experimental
description: Detects application-layer indicators of SQL injection attempts against Marten LINQ and tenant-management query paths (CVE-2026-75513), where unescaped single quotes escape generated SQL literals.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75513
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.75513
logsource:
  category: application
  product: marten
detection:
  selection_quote:
    message|contains:
      - "''"
      - "';"
      - "' OR "
      - "' AND "
      - "' UNION"
      - "'--"
  selection_context:
    message|contains:
      - "DictionaryItemMember"
      - "DictionaryContainsKeyFilter"
      - "SelectParser"
      - "DeleteAllForTenant"
      - "DatabaseScopedTenantPartitions"
      - "EventLoader"
  condition: selection_quote and selection_context
falsepositives:
  - Legitimate document content containing apostrophes within dictionary keys
  - Application log entries containing raw SQL for debugging
level: high

YARA Rule

rule CVE_2026_75513_Marten_SQLi_Indicators
{
    meta:
        description = "Detects Marten source/assemblies exhibiting the unescaped single-quote literal interpolation pattern associated with CVE-2026-75513"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75513"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $s1 = "DictionaryItemMember" ascii wide
        $s2 = "DictionaryContainsKeyFilter" ascii wide
        $s3 = "DatabaseScopedTenantPartitions" ascii wide
        $s4 = "DeleteAllForTenant" ascii wide
        $s5 = "DeleteProjectionProgressAsync" ascii wide
        $s6 = "EventLoader" ascii wide
        $q1 = "'" ascii
        $sqli1 = "'' + " ascii wide
        $sqli2 = "+ \"'\"" ascii wide
        $sqli3 = "'\" +" ascii wide
        $ver1 = "7.0.0" ascii
        $pkgs = "Marten" ascii wide

    condition:
        $pkgs and (3 of ($s*) or (1 of ($sqli*) and 2 of ($s*)))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75513 Marten LINQ SQL Injection Attempt - Single Quote Payload"; flow:established,to_server; http.method; content:"GET|POST|PUT|PATCH"; http.uri; content:"'"; http.uri; content:"OR"; http.uri; nocase; http.uri; content:"--"; http.uri; reference:cve,2026-75513; classtype:web-application-attack; sid:202675513; rev:1;)

alert http any any -> any any (msg:"CVE-2026-75513 Marten SQL Injection - UNION/Stacked Query Indicator"; flow:established,to_server; http.request_body; content:"'"; http.request_body; pcre:"/'\s*(UNION|SELECT|INSERT|UPDATE|DELETE|;)/i"; reference:cve,2026-75513; classtype:web-application-attack; sid:202675514; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5s
  [any where
     process.name : ("dotnet", "w3wp.exe") and
     event.category == "process" and
     (process.command_line : "*Marten*" or process.args : "*Marten*")]
  [any where
     event.category == "database" and
     (event.action == "query" or event.type == "access") and
     wildcard(query.text, "*' OR *") or
     wildcard(query.text, "*' UNION*") or
     wildcard(query.text, "*';*") or
     wildcard(query.text, "*' AND *")]

Splunk SPL Query

index=marten OR index=postgres OR index=app
(sourcetype="marten:query" OR sourcetype="postgresql:log" OR sourcetype="dotnet:app")
("DictionaryItemMember" OR "DictionaryContainsKeyFilter" OR "DatabaseScopedTenantPartitions" OR "DeleteAllForTenant" OR "EventLoader")
("'" OR "''" OR "' OR " OR "' UNION" OR "';")
| eval risk="CVE-2026-75513 SQLi"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(message) as sample_messages
        by src_ip, host, user, risk
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,marten,sql_injection,">
  <rule id="100755" level="12">
    <if_sid>31103,31104,31106</if_sid>
    <field name="url" negate="no">'</field>
    <description>CVE-2026-75513 - Potential Marten SQL injection: single-quote character in request URL targeting LINQ/tenant query path</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_75513,sql_injection,</group>
  </rule>

  <rule id="100756" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">'(\s)*(OR|AND|UNION|;)</field>
    <description>CVE-2026-75513 - SQL injection pattern detected in Marten application log</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_75513,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). The advisory states the issue is fixed in version 9.13.0, but no fix artifact was corroborated by tracked sources, and no vendor workaround is available in the data provided. Treat all mitigations below as compensating controls until 9.13.0 can be validated in your environment.

1) Immediate mitigations (compensating controls).

• Restrict the attack surface at the data layer. Enforce least privilege on the Npgsql database role used by Marten: revoke superuser rights, revoke broad DDL/DML grants, and limit the role to only the schemas/operations the application requires. This blunts the data-modification path even where injection succeeds.
• Disable semicolon-batched statements in the Npgsql connection configuration. The advisory specifically ties data-modification impact to deployments that permit semicolon-batched statements; disabling batching reduces a successful injection to an inference/exfiltration channel.
• Harden input handling at the application boundary. Validate and reject inputs containing single-quote characters in fields that flow into Marten LINQ Where filters and dictionary indexers, and into any user-controlled tenant identifiers. This is a stopgap, not a substitute for the vendor fix.
• Enforce the System.Text.Json serializer path where feasible, since the advisory states the DictionaryContainsKeyFilter.cs sink affects Newtonsoft-serializer deployments only and that System.Text.Json is not affected through that sink. This does not remediate the primary DictionaryItemMember.cs vector or the tenant-management sinks.
• Segment and monitor database access. Apply network segmentation and alert on anomalous or unexpected SQL shapes originating from Marten application hosts.

2) Patch / upgrade steps.

• Upgrade Marten to 9.13.0 or later. Confirm the upgrade in staging with the application's actual LINQ and tenant-management code paths exercised, since the advisory names multiple independent sinks.
• Because patch confidence is 0/4 and no fix artifact has been corroborated, verify the vendor's 9.13.0 release notes and source changes directly before treating the issue as resolved.
• After upgrading, re-test dictionary-key filters, ContainsKey calls, IEventStore.DeleteProjectionProgressAsync usage, and tenant-partitioned queries for residual injection behavior.

3) Long-term hardening.

• Adopt parameterized queries as the only accepted pattern for any SQL construction in application code and ORM extensions; ban string interpolation into SQL literals via code review and static analysis (SAST rules targeting interpolation into quoted literals).
• Add CI gates that run SAST/DAST against Marten-backed data access paths and fail builds on CWE-89 findings.
• Maintain a response plan for upstream ORM/Npgsql advisories, given that query-translation layers are a recurring injection surface.
• Instrument database telemetry (PostgreSQL query and error logs) and forward to the SIEM with the detections above, so future SQLi classes in this dependency are caught quickly.
• Reassess multi-tenant isolation controls independently of Marten, e.g., defense-in-depth row-level security in PostgreSQL, so a single ORM-layer flaw does not directly expose cross-tenant data.

References

1. NVD — CVE-2026-75513: https://nvd.nist.gov/vuln/detail/CVE-2026-75513
2. Marten (project/repository) — primary source for the advisory and the 9.13.0 fix; consult the project's release notes for version 9.13.0 and the affected source files (src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs, SelectParser.cs, DatabaseScopedTenantPartitions.cs, DeleteAllForTenant.cs, DictionaryContainsKeyFilter.cs, Events/Daemon/Internals/EventLoader.cs).
3. CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-75513 is not listed as of this report: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: No public PoC, exploit code, or Nuclei template was available at the time of writing. No CISA KEV listing and no attributed threat-actor campaign. No EPSS score has been assigned by FIRST.org as of this report; no EPSS value is asserted.