Vulnerability · Published Jul 29, 2026 · Assigned by BlackDuck
CVE-2026-8339SQL Injection in Coverity Connect SOAP API
High 8.7
In plain English
A high-severity SQL injection in Coverity Connect from Black Duck. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.3%top 71.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Black Duck | Coverity Connect | 2024.6.0 – before 2026.6.0 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N