Security readout for executives and security teams
Plain-English summary
CVE-2026-0824 is a cross-site scripting issue in the QuestDB UI Web Console. A user with some privileges can reportedly trigger script execution through the console, requiring user interaction. Public exploit material is reported, but KEV does not list active exploitation. Treat this as a timely patching item, especially where QuestDB consoles are reachable by untrusted users.
Executive priority
Prioritize remediation in the next normal patch cycle, sooner for internet-exposed or broadly accessible consoles. The issue is not currently KEV-listed, but public exploit availability and administrative-console context raise practical risk. Restrict access while patch status is confirmed.
Technical view
VulDB describes XSS in an unknown QuestDB UI Web Console function, remotely triggerable, affecting UI versions up to 1.11.9. CVSS 4.0 is 5.1 with low attack complexity, low privileges required, and user interaction required. The listed patch commit is b42fd9f18476d844ae181a10a249e003dafb823d; sources also reference release in QuestDB 9.3.0.
Likely exposure
Exposure is most relevant for organizations running QuestDB with the UI Web Console enabled, especially if accessible beyond trusted administrators. The source bundle lists QuestDB UI 1.11.0 through 1.11.9 as affected. Version information in the bundle is inconsistent around 1.1.10, so verify directly against vendor release guidance.
Exploitation context
The source bundle says an exploit has been released publicly and may be used for attacks. However, KEV is false and no cited source confirms active exploitation. The CVSS vector indicates exploitation requires low privileges and user interaction, limiting fully unauthenticated drive-by risk but still creating browser-session and data-integrity concerns.
Researcher notes
Evidence identifies the component as QuestDB UI Web Console but not the exact vulnerable function. CWE mappings include CWE-79 and CWE-94, though the described impact is XSS. Validate version applicability carefully because the bundle both recommends 1.1.10 and lists it among affected entries.
Mitigation direction
- Upgrade the affected QuestDB UI component per vendor guidance.
- Review QuestDB 9.3.0 release notes for inclusion of the fix.
- Confirm whether commit b42fd9f18476d844ae181a10a249e003dafb823d is present in deployed UI code.
- Restrict Web Console access to trusted administrative networks and users.
- Monitor vendor advisories for clarification on 1.1.10 versus 1.11.x versioning.
Validation and detection
- Inventory QuestDB instances and identify exposed Web Console endpoints.
- Record QuestDB and QuestDB UI versions in each environment.
- Check whether deployed UI code includes the referenced patch commit.
- Review access controls for consoles reachable from untrusted networks.
- Search security telemetry for suspicious Web Console interactions without using public exploit details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0824 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-340357 | questdb ui Web Console cross site scriptingCVE reference · vdb-entry, technical-description
- VDB-340357 | CTI Indicators (IOB, IOC, TTP)CVE reference · signature, permissions-required
- Submit #733253 | questdb V9.2.3(latest) xssCVE reference · third-party-advisory
- https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20QuestDB%20database.mdCVE reference · related
- https://github.com/questdb/questdb/releases/tag/9.3.0CVE reference · patch
- https://github.com/questdb/ui/pull/519#issue-3790862030CVE reference · exploit, issue-tracking
- https://github.com/questdb/ui/commit/b42fd9f18476d844ae181a10a249e003dafb823dCVE reference · patch
- https://github.com/questdb/ui/pull/518CVE reference · issue-tracking, patch
- https://github.com/questdb/ui/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.