CVE-2026-10880: Unauthenticated SQL Injection in Osnexus Quantastor

Synopsis

This is an unauthenticated SQL injection vulnerability in OSNexus QuantaStor SDS Manager affecting versions 5.9 through 6.6.0. The flaw is reachable over the network with no credentials required: an attacker sends a crafted username string to the login endpoint, manipulating the underlying SQL query to bypass authentication entirely and gain administrator access. Successful exploitation gives the attacker full administrative control over the storage management interface. A patched-image rebuild at version 6.6.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the QuantaStor SDS Manager login endpoint over the network; no local or physical access is assumed.

• AuthenticationNot required

  No credentials of any kind are needed; the injection is triggered at the pre-authentication login endpoint.

• Victim interactionNot required

  The attacker sends a crafted request directly to the service with no user interaction required.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or environmental setup is required.

Blast Radius

• A successful attacker bypasses authentication and logs in as an administrator without a valid password, gaining full control of the QuantaStor management interface.
• With administrative access, the attacker can read all stored configuration data, credentials, and storage metadata managed by the SDS instance.
• The attacker can modify or delete storage volumes, pools, and shares, corrupting or destroying persisted data.
• The attacker can crash or shut down the QuantaStor management service, taking storage provisioning and management offline.