CVE-2026-0603 Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat AMQ Broker 7
cpes: cpe:/a:redhat:amq_broker:7
default_status: affected
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
cpes: cpe:/a:redhat:optaplanner:::el6
default_status: affected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Dev Spaces
cpes: cpe:/a:redhat:openshift_devspaces:3
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Dev Spaces
cpes: cpe:/a:redhat:openshift_devspaces:3
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Christiaan Swiers (YouGina) and Tommy Williams (HeroDevs) for reporting this issue.
Published: 2026-01-23T06:31:38.975Z