CVE-2026-57190
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Record
CVE-2026-57190- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-111401
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Record
EUVD-2026-111401- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L - Updated
- 2026-11-02
NVD
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Record
CVE-2026-57190- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Record
CVE-2026-57190- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-57190
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Record
DEBIAN-CVE-2026-57190- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-57190
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The cel_pgsql or cel_tds backend must be loaded and configured, and the administrator must call CELGenUserEvent in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Record
UBUNTU-CVE-2026-57190- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:22.10.1+dfsg+~cs6.17.60671434-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:22.10.1+dfsg+~cs6.17.60671434-1 |
asteriskUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:13.1.0~dfsg-1.1ubuntu31:13.1.0~dfsg-1.1ubuntu41:13.1.0~dfsg-1.1ubuntu4.11:13.1.0~dfsg-1.1ubuntu4.1+esm1 |
None known |
asteriskUbuntu:18.04:LTS |
All versions, plus listed versions 1:13.17.2~dfsg-1ubuntu11:13.17.2~dfsg-2ubuntu11:13.18.1~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu21:13.18.3~dfsg-1ubuntu31:13.18.3~dfsg-1ubuntu4 |
None known |
asteriskUbuntu:20.04:LTS |
All versions, plus listed versions 1:16.2.1~dfsg-2build21:16.2.1~dfsg-2build31:16.2.1~dfsg-2ubuntu1 |
None known |
asteriskUbuntu:22.04:LTS |
All versions, plus listed versions 1:16.16.1~dfsg-21:16.16.1~dfsg-41:16.16.1~dfsg-4build11:16.16.1~dfsg+~2.10-11:18.10.0~dfsg+~cs6.10.40431411-2 |
None known |
asteriskUbuntu:24.04:LTS |
All versions, plus listed versions 1:20.4.0~dfsg+~cs6.13.40431414-21:20.5.0~dfsg+~cs6.13.40431414-11:20.5.1~dfsg+~cs6.13.40431414-11:20.5.2~dfsg+~cs6.13.40431414-11:20.6.0~dfsg+~cs6.13.40431414-1 Show 4 moreShow less1:20.6.0~dfsg+~cs6.13.40431414-21:20.6.0~dfsg+~cs6.13.40431414-2build31:20.6.0~dfsg+~cs6.13.40431414-2build41:20.6.0~dfsg+~cs6.13.40431414-2build5 |
None known |
asteriskUbuntu:26.10 |
All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-11:22.10.0+dfsg+~cs6.17.60671434-1ubuntu21:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3 |
None known |
asteriskUbuntu:26.04:LTS |
All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57190 is a high vulnerability (CVSS 7.0) in Asterisk, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in asterisk 1:22.10.1+dfsg+~cs6.17.60671434-1.
References
github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-57190
security-tracker.debian.org/tracker/CVE-2026-57190
ubuntu.com/security/CVE-2026-57190
cve.org/CVERecord?id=CVE-2026-57190
Left out here: 244 versions. The JSON record has them.