JSON-SCADA High-Severity SQL Injection Lets Users Alter Historian Records in Pre-0.65 Versions

JSON-SCADA versions earlier than 0.65-alpha contain a confirmed SQL injection vulnerability that compromises data integrity for authenticated users. According to the National Vulnerability Database, this flaw exists in the opcApi() function located in the src/server_realtime_auth/index.js file. The vulnerability allows attackers to inject malicious SQL commands through HistoryReadRequest parameters. This exposure affects how the application processes historical data requests from connected clients.

The risk

The underlying weakness is classified as CWE-89, indicating improper neutralization of special elements in SQL commands. Attackers can inject stacked SQL statements through specific input fields, including NodeId.Id, StartTime, or EndTime values. This capability permits reading, modifying, or deleting historian data across all configured locations. The impact is significant because the injection bypasses standard role-based access controls, allowing lower-privilege users to affect high-value data sets.

Who is exposed

The vulnerability affects all installations of JSON-SCADA running versions before 0.65-alpha. The product is maintained by riclolsen. Any organization using this software for operational technology monitoring or historical data storage is potentially at risk if they have not updated to the patched version. The flaw requires an authenticated user, meaning attackers must first obtain valid login credentials to exploit the injection vector.

Cost and compliance

The National Vulnerability Database assigns a CVSS score of 8.7, categorizing the severity as HIGH. This rating reflects the potential for significant data manipulation and the ease of exploitation for authenticated users. Organizations relying on JSON-SCADA for critical infrastructure monitoring must consider the integrity implications of this flaw. Compliance frameworks requiring data integrity and access control may be violated if this vulnerability remains unaddressed in production environments.

What to watch

Security teams should prioritize inventorying all JSON-SCADA instances to identify versions prior to 0.65-alpha. Monitor for unusual data modifications or deletions in historian records, especially from users with limited permissions. Verify that access logs show no evidence of SQL injection attempts through the HistoryReadRequest parameters.

Signals worth monitoring

Teams usually detect this activity by reviewing application logs for malformed SQL queries or unexpected error messages originating from the opcApi() endpoint. Check whether database audit trails show direct manipulation commands issued by application service accounts rather than standard API calls. Look for sudden changes in historical data values that do not correlate with physical sensor inputs. Containment moves typically involve restricting access to the affected API endpoints and reviewing user permissions to limit potential damage while preparing for updates.

What to do and how to stay safe: JSON-SCADA

• Audit your JSON-SCADA installations to confirm versions are at or above 0.65-alpha.
• Review database audit logs for unauthorized INSERT, UPDATE, or DELETE statements.
• Restrict access to the opcApi() endpoint to trusted internal networks only.
• Monitor for anomalous HistoryReadRequest patterns that may indicate injection attempts.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this JSON-SCADA vulnerability?

The vulnerability is tracked as CVE-2026-115328.

Which versions of JSON-SCADA are affected by this flaw?

All versions before 0.65-alpha are vulnerable to this SQL injection issue.

Does this vulnerability require authentication to exploit?

Yes, the flaw allows authenticated users to inject SQL commands via specific parameters.