CVE-2026-49490: OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column

Synopsis

SQL injection in OpenCATS affects the DataGrid filter handling for the Candidates module, reachable over the network by any authenticated user. An attacker with a low-privilege account can craft a malicious filter request targeting the Tags column to bypass filterable-column restrictions and execute arbitrary SQL queries against the underlying database. Successful exploitation gives the attacker full read and write access to database contents. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable DataGrid endpoint is exposed over the network, so the attacker must be able to reach the OpenCATS service via HTTP or HTTPS.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative rights are needed to send crafted filter requests to the Candidates DataGrid.

• Victim interactionNot required

  The attacker sends requests directly to the server and does not need any other user to take an action.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory layout dependencies, or other environmental factors need to align for the injection to succeed.

Blast Radius

• Reads all data stored in the OpenCATS database, including candidate records, contact details, resumes, and stored credentials or session tokens.
• Modifies or deletes persisted database rows, including candidate profiles, job pipeline data, and user account information.
• Enables privilege escalation within the application by overwriting user role or password data directly in the database.