CVE-2026-45288: Marten has an SQL injection vulnerability in its full-text search regConfig parameter

Synopsis

SQL injection in Marten, a .NET document database and event store library built on PostgreSQL, allows an unauthenticated attacker to reach the vulnerability over the network without any prior access. The flaw exists because the regConfig parameter in Marten's full-text search APIs is interpolated directly into generated SQL without parameterization or sanitization, giving an attacker full read, write, and denial-of-service capability against the underlying PostgreSQL database. A patched rebuild at version 8.36.1 is available on HarborGuard for any environment running an affected version of Marten.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the service over the network; no local access or special network position is needed.

• AuthenticationNot required

  No credentials or session token of any kind are required to trigger the injection.

• Victim interactionNot required

  The attacker acts entirely on their own; no user needs to click a link or take any action.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or environmental setup.

Blast Radius

• A successful attacker reads arbitrary data from the PostgreSQL database, including stored documents, event streams, session tokens, and any other persisted records.
• The attacker writes or modifies rows in the database, including forging documents, altering event history, or escalating their own privileges within the application.
• The attacker can crash or degrade the database service, causing a denial of service for all application workloads that depend on it.
• Depending on PostgreSQL server configuration, the attacker may be able to invoke server-side functions or access the host filesystem through the database engine.