External risk intelligence

NginxPulse SQL Injection Vulnerability in API Stats

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-129171

The vulnerability exists in an API endpoint (/api/stats/:type) of NginxPulse, which is designed for monitoring and analytics. Such services are commonly deployed as public-facing or edge-accessible endpoints to provide real-time metrics, making this surface inherently exposed to the internet by design.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in NginxPulse allows unauthenticated attackers to inject SQL commands through API parameters, potentially leading to the exposure or modification of database contents and server files. This issue could have significant implications for data security and system integrity if NginxPulse is deployed in your environment. The primary concern is to confirm if this specific technology is in use and if it is exposed in a way that would allow external access.

Unauthenticated SQL injection in NginxPulse API.
Protects sensitive database and server file access.
Confirm usage and exposure to assess risk.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted requests to the /api/stats/:type endpoint. Because no authentication is required, an unauthenticated remote attacker can send a malicious request to the server, leveraging the `id` and `locationType` parameters. This can lead to the disclosure of sensitive database information and potentially allow the attacker to execute arbitrary commands on the server with superuser privileges if PostgreSQL is used.

No authentication is required for access.
SQL injection via `id` and `locationType` parameters.
Database contents can be read; files can be read/written.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in NginxPulse could allow unauthenticated attackers to access and potentially modify database contents or server files. When supported by the advisory, this could occur by exploiting SQL injection flaws in API parameters, leading to the disclosure of sensitive information or unauthorized data manipulation.

Database contents and server files.
Via SQL injection in API parameters.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the vulnerability in NginxPulse's API, application owners and platform teams are likely responsible for remediation. The first practical step is to identify all instances of NginxPulse, determine their exposure and criticality, and then coordinate with the vendor for a fix or implement compensating controls.

Application or platform teams own the issue.
Verify NginxPulse reachability and business criticality.
Plan coordinated remediation with vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NginxPulse?

NginxPulse is a software tool used for monitoring and analyzing web server performance metrics. It provides real-time insights into system health and traffic patterns, typically by gathering data from infrastructure endpoints to help administrators understand how their services are behaving.

What does SQL injection mean for CVE-2026-129171?

This vulnerability, classified as CWE-89, occurs when an application improperly handles user-provided data in a database query. In CVE-2026-129171, the software fails to sanitize input, allowing an attacker to insert their own commands into the database. This lets them break out of the intended query to view private data or interact with the underlying server.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted request to the /api/stats/:type endpoint. They specifically manipulate the 'id' and 'locationType' parameters to inject malicious code. Notably, simply browsing the main interface or accessing different, unaffected API endpoints does not trigger the flaw; the malicious payload must be delivered specifically through these monitored parameters.

Is my NginxPulse instance at risk?

Halo Surface Signal indicates that because this vulnerability exists in an API endpoint designed for real-time monitoring, such services are often deployed as public-facing or edge-accessible by design. If your instance is reachable from the internet, it is inherently exposed, as the vulnerability requires no authentication to exploit.

What should I do to secure my NginxPulse deployment?

First, locate all running instances of NginxPulse within your infrastructure to understand where this software is active. Once identified, evaluate whether those instances are accessible from the internet. Finally, work with your team to update to version 1.6.26 or later, as this version contains the necessary fixes to prevent unauthorized database and file access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.