CVE-2026-55721: SQL Injection in StoneFly Storage Concentrator

Synopsis

SQL injection in StoneFly Storage Concentrator (SC and SCVM) allows an unauthenticated remote attacker to manipulate database queries through unsanitized cookie values processed by the login.pl and debug.pl scripts. The vulnerability is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation gives the attacker read access to session tokens, password hashes, and stored secret keys, and limited write access to the underlying database. Patched-image rebuilds at versions 8.0.4.22 and 8.0.4.29 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Storage Concentrator service over the network; the vulnerable scripts are exposed via standard HTTP/HTTPS endpoints.

• AuthenticationNot required

  No credentials are needed; the injection point is the cookie header processed before any authentication check, so the attacker requires no account on the target system.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the target; no user action or social engineering is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of the target environment beyond network access.

Blast Radius

• Reads session tokens stored in the database, enabling session hijacking against authenticated users.
• Reads password hashes and stored secret keys, which can be cracked offline or used directly to escalate access.
• Writes limited modifications to persisted database rows in the directly affected system (low integrity impact on the Storage Concentrator itself).
• Reads data from systems that the Storage Concentrator database has trust relationships with, extending the confidentiality exposure beyond the immediate host (high confidentiality impact on downstream or connected components).