CVE-2026-48188
SQL Injection via MySQL Quote Method
- Published
- Updated
- Reserved
- Assigned by
- OTRS
Description
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X * (OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| OTRSCNA (assigner) | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Analyzed | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.
Weakness
Affected products
- affected 7.0.x
- affected 8.0.x
- affected 2023.x
- affected 2024.x
- affected 2025.x
- affected 2026.x – ≤ 2026.3.x
OTRS AG · ((OTRS)) Community Edition
- affected 6.x
What to do
Solution: Update to OTRS 2026.4.1. or later. Please note that there will be no OTRS 7 patches
Workaround: Reconfigure MySQL/MariaDB servernot to use NO_BACKSLASH_ESCAPES SQL
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-48188)Record last updated .