Key points
- CVE-2026-115328 is rated CVSS 8.7 HIGH in the National Vulnerability Database.
- The flaw exists in the opcApi function within the realtime authentication module.
- Affected versions are those before 0.65-alpha; no patch status is provided.
The open-source industrial automation platform JSON-SCADA contains a high-severity SQL injection vulnerability affecting all versions released before 0.65-alpha. According to the National Vulnerability Database record for CVE-2026-115328, this flaw carries a CVSS score of 8.7. The issue allows any authenticated user to execute arbitrary SQL commands against the application’s database. This capability extends beyond simple data retrieval, potentially enabling modification or deletion of critical historian records across all configured locations.
In plain English
SQL injection occurs when an application fails to properly sanitize user input before passing it to a database query. In this case, the JSON-SCADA server accepts specific parameters from authenticated users through its OPC API interface. The vulnerability resides in the src/server_realtime_auth/index.js file, specifically within the opcApi function. Attackers can inject malicious SQL code through the HistoryReadRequest parameters. By manipulating the NodeId.Id, StartTime, or EndTime values, a user can force the database to execute unintended commands. This bypasses normal role-based access controls, allowing even low-privilege accounts to access or alter data they should not touch.
The background
The vulnerability is tracked as CVE-2026-115328 and maps to CWE-89, the standard classification for SQL injection weaknesses. The source material identifies the affected software as json-scada, maintained by developer riclolsen. The flaw specifically targets the historian data component, which records time-series information for industrial processes. Because the injection works through authenticated API calls, it does not require external network access or unauthenticated login attempts. The severity rating of 8.7 reflects the high impact on data integrity and confidentiality when an attacker can read, modify, or delete records regardless of their assigned role permissions.
What changes now
Security teams must immediately verify if their environments run JSON-SCADA versions older than 0.65-alpha. The source material does not confirm whether a patch or updated version is available. The primary risk is internal compromise, as the flaw requires an authenticated user account. Teams should review audit logs for unusual HistoryReadRequest activity, particularly those with complex or unexpected StartTime and EndTime parameters.
The source notes that attackers can inject stacked statements through these values. Monitoring for such patterns is essential to detect potential abuse. Until a secure version is confirmed, limiting access to the OPC API and monitoring historian data integrity are essential mitigation steps.
Who needs to act first
Teams usually prioritize systems exposed to internal networks where authenticated users have access to the OPC API. Check whether any workstations or service accounts can reach the JSON-SCADA interface. Verify current version numbers against the pre-0.65-alpha threshold. If vulnerable versions are present, isolate those instances from general network traffic if possible. Ensure that backup procedures are active and recent, protecting historian data from potential deletion. Monitor authentication logs for anomalous query patterns. Restrict API access to only those personnel who strictly require historian data for their daily operations.
Background: Role-based access control
Role-based access control assigns permissions to predefined roles instead of individual users. This method simplifies permission management and limits data exposure. You create roles that match job functions, then assign users to those roles. This ensures employees only access the data they need to perform their specific tasks.
Read the full guide: Role-Based Access Control: 8 FAQ Answers for Secure Systems
What to do and how to stay safe: JSON-SCADA
- Audit all JSON-SCADA instances to confirm they are running version 0.65-alpha or later.
- Review API logs for HistoryReadRequest entries with unusual StartTime or EndTime values.
- Restrict network access to the OPC API interface to limit potential attack surfaces.
- Monitor historian databases for unexpected data modifications or deletions.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-115328?
The National Vulnerability Database rates the vulnerability as 8.7, which is classified as HIGH severity.
Which versions of JSON-SCADA are affected?
All versions of JSON-SCADA prior to 0.65-alpha are affected by this SQL injection flaw.
Does an attacker need to be logged in to exploit this?
Yes, the vulnerability allows authenticated users to inject SQL via HistoryReadRequest parameters.
