Unauthenticated SQL injection *.nasa.gov

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 2 Nov 2026 10 days ago
Priority P1 Bugcrowd's VRT priority rating
Status Resolved This vulnerability has been accepted and fixed

Summary by Sleibe

Unauthenticated SQL injection in NASA's ArcGIS queryAnalytic endpoint, allowing arbitrary PostgreSQL expression execution through the unfiltered analyticWhere parameter. Confirmed time-based and boolean-based SQL injection, PostgreSQL fingerprinting, and excessive database privileges, including INSERT, UPDATE, DELETE, TRUNCATE, and CREATE.

Unauthenticated SQL injection *.nasa.gov

Summary by Sleibe

Activity