DEV Community

facilishz
facilishz

Posted on

Reading the CVSS 9.8 score of CVE-2026-108474 without overreading it

#cybersecurity #sql #database #security

Reading the CVSS 9.8 score of CVE-2026-108474 without overreading it

Vulnerability overview

CVE-2026-108474 carries a CVSS v3 score of 9.8 and is classified as CWE-89, SQL injection. It affects JetBrains Exposed before 1.5.1, with 1.5.1 as the fixed release. A 9.8 is a strong signal, and it is worth reading precisely rather than treating the decimal as a verdict.

Mechanism and exploitation conditions

The flaw comes from SQL functions in the framework that do not escape string arguments, and it can be triggered without authentication. Those two properties explain the score: no credential barrier and a direct path to a sensitive operation. What the score does not encode is whether untrusted input reaches an affected function in any particular deployment. A service that never forwards external data into those helpers has the vulnerable library without an obvious way to reach the flaw.

Impact

Where the flaw is reachable, impact scales with the database account privileges. Where it is not reachable, the practical risk is lower even though the number is unchanged. The source report notes no confirmed exploitation in the wild and no public proof of concept, so the score reflects potential rather than observed incidents.

Affected products and scope

Exposed before 1.5.1. The same JetBrains October 2026 batch fixed TeamCity issues CVE-2026-106218 (CVSS 8.8, CWE-184) and CVE-2026-106219 (CVSS 6.5, CWE-73), which sit at different points on the same scale.

Exposure context

A ZoomEye query for the TeamCity fingerprint app="JetBrains TeamCity" returned 1,867 assets, describing visible build servers rather than library deployments. A query for vul.cve="CVE-2026-108474" returned zero indexed matches.

Remediation and mitigations

Patch to Exposed 1.5.1 and rebuild. Then convert the score into a decision for your environment: identify services that pass external input into SQL helpers, confirm their call sites bind parameters and check the privileges of their database accounts. The score sets priority; reachability and privilege set the outcome.

References

Top comments (0)