SQL injection in Hibernate ORM - CVE-2026-0603
Published: August 31, 2026
Vulnerability identifier: #VU146432
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-0603
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and manipulate or delete data.
The vulnerability exists due to sql injection in InlineIdsOrClauseBuilder when processing ID values containing unsanitized non-alphanumeric characters. A remote user can supply crafted input to disclose sensitive information and manipulate or delete data.
This is only exploitable if the user is able to set their own IDs, those IDs allow non-alphanumeric characters, and the application is using InlineIdsOrClauseBuilder.
Affected software
Hibernate ORM
Crowd Data Center
Confluence Data Center
Bamboo Data Center
Crowd Data Center
Confluence Data Center
Bamboo Data Center
How to mitigate CVE-2026-0603
Install security update from vendor's website.
Hibernate ORM - update to 5.3.38
Crowd Data Center - update to 7.2.2
Confluence Data Center - addressed in versions 9.2.23, 10.2.15
Bamboo Data Center - update to 12.1.10
Crowd Data Center - update to 7.2.2
Confluence Data Center - addressed in versions 9.2.23, 10.2.15
Bamboo Data Center - update to 12.1.10