Medium 5.4Published Feb 3, 2026

CVE-2026-1207Potential SQL injection via raster lookups on PostGIS

Updated under an hour ago (Oct 27, 2026, 6:10 AM ET)

Does this affect you?

It affects djangoproject Django and 8 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for djangoproject Django

Exploited in the last 30 days

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

CVSS: 5.4 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-89
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: DSF
NVD analysis: Modified
Record last updated: Jul 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

djangoproject Django djangoproject:django (from the name)	from 6.0 before 6.0.2; 6.0.2 not affected; from 5.2 before 5.2.11; 5.2.11 not affected; from 4.2 before 4.2.28; 4.2.28 not affected	CNA record
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 redhat:ansible_automation_platform	from 0:4.2.28-1.el8ap not affected	CISA ADP
Red Hat Red Hat Satellite 6.16 for RHEL 8 redhat:satellite	from 0:4.2.28-0.1.el8pc not affected	CISA ADP
Red Hat Red Hat Satellite 6.16 for RHEL 8 redhat:satellite_capsule	from 0:4.2.28-0.1.el8pc not affected	CISA ADP
Red Hat Red Hat Satellite 6.17 for RHEL 9 redhat:satellite_maintenance	from 0:3.14.0.14-1.el9sat not affected	CISA ADP
Red Hat Red Hat Satellite 6.17 for RHEL 9 redhat:satellite_utils	from 0:3.14.0.14-1.el9sat not affected	CISA ADP
Red Hat Red Hat Discovery 2 redhat:discovery	from 1770913597 not affected	CISA ADP
Red Hat Red Hat OpenStack Platform 16.2 redhat:openstack	16.2	CISA ADP
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers redhat:rhui	4	CISA ADP
djangoproject django djangoproject:django	from 4.2 before 4.2.28; from 5.2 before 5.2.11; from 6.0 before 6.0.2	NVD

References

References

https://docs.djangoproject.com/en/dev/releases/security/	vendor-advisory, patch
https://groups.google.com/g/django-announce	mailing-list, release-notes
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/	vendor-advisory, patch
https://access.redhat.com/errata/RHSA-2026:14835
https://access.redhat.com/errata/RHSA-2026:2694
https://access.redhat.com/errata/RHSA-2026:3958
https://access.redhat.com/errata/RHSA-2026:3959
https://access.redhat.com/errata/RHSA-2026:3960
https://access.redhat.com/errata/RHSA-2026:3962
https://access.redhat.com/errata/RHSA-2026:5970
1–10 of 15

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.