CVE-2026-1207

Confirmed PUBLISHED

Potential SQL injection via raster lookups on PostGIS

djangoproject · Django

Not yet in CISA KEV

Exploited in the wild Active exploitation observed PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

Not yet in CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

5.4 Medium EPSS 9.4%

At a Glance

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

nuclei_scanner

CVE Published: Feb 03, 2026
Exploited Since: Jun 12, 2026
CVSS: 5.4 Medium
EPSS: 9.4%

Remote Low complexity No user interaction

Affected Versions

40 version rows · page 1 of 2

Vendor	Product	Version	Status
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-django	0:4.2.28-1.el8ap to < *	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-django	0:4.2.28-1.el9ap to < *	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-django	0:4.2.28-1.el9ap to < *	Unaffected
Red Hat	Red Hat Satellite 6.16 for RHEL 8 python-django	0:4.2.28-0.1.el8pc to < *	Unaffected
Red Hat	Red Hat Satellite 6.16 for RHEL 9 python-django	0:4.2.28-0.1.el9pc to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 foreman	0:3.14.0.14-1.el9sat to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 libcomps	0:0.1.23-0.3.el9pc to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 python-brotli	0:1.2.0-0.1.el9pc to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 python-django	0:4.2.28-0.1.el9pc to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 python-pulp-container	0:2.22.3-1.el9pc to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 python-pulp-rpm	0:3.27.10-2.el9pc to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 rubygem-fog-kubevirt	0:1.5.1-1.el9sat to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 rubygem-foreman_kubevirt	0:0.4.3-1.el9sat to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 rubygem-katello	0:4.16.0.14-1.el9sat to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 rubygem-rubyipmi	0:0.13.0-1.el9sat to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 satellite	0:6.17.7-1.el9sat to < *	Unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9 yggdrasil-worker-forwarder	0:0.0.3-4.el9sat to < *	Unaffected
Red Hat	Red Hat Satellite 6.18 for RHEL 9 python3.12-django	0:4.2.30-1.el9pc to < *	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8	1772214630 to < *	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-rhel9	1772552788 to < *	Unaffected
Red Hat	Red Hat Discovery 2 discovery/discovery-server-rhel9	1770913597 to < *	Unaffected
Red Hat	Red Hat Satellite 6.18 satellite/iop-advisor-backend-rhel9	1773451075 to < *	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/de-minimal-rhel8	All versions (default: unaffected)	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/de-minimal-rhel9	All versions (default: unaffected)	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/de-minimal-rhel8	All versions (default: unaffected)	Unaffected

CVE References

Django security archive docs.djangoproject.com · Vendor Advisory https://docs.djangoproject.com/en/dev/releases/security/
Django security releases issued: 6.0.2, 5.2.11, and 4.2.28 djangoproject.com · Vendor Advisory https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
Django releases announcements groups.google.com · Mailing List https://groups.google.com/g/django-announce

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2026-07-06 00:00 UTC
KEVIntel	2026-07-09 16:15 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 2
Distinct User-Agents: 14

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1207.yaml	Jun 01, 2026

CVSS Scores

CVSS v3.1 5.4 Medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitation Status

Exploited in the wild

Recorded 2026-07-06 00:00:00 UTC · The Shadowserver

Active exploitation observed

Recorded 2026-06-12 00:35:32 UTC · KEVIntel sensor

Proof of concept available

Recorded 2026-06-12 14:21:11 UTC · Nuclei Templates

Weaknesses (CWE)

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1207.yaml	Jun 01, 2026

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Django RasterField - SQL Injection

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

10 Jul 2026 08:05 UTC 9 days ago

10 Jul 2026 08:05 UTC · 9 days ago

Virtual patch available

Compensating WAF rule available to block exploitation
6 Jul 2026 00:00 UTC 13 days ago

6 Jul 2026 00:00 UTC · 13 days ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
12 Jun 2026 14:21 UTC about 1 month ago

12 Jun 2026 14:21 UTC · about 1 month ago

Public PoC available

Public proof-of-concept code published
12 Jun 2026 00:35 UTC about 1 month ago

12 Jun 2026 00:35 UTC · about 1 month ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
12 Jun 2026 00:35 UTC about 1 month ago

12 Jun 2026 00:35 UTC · about 1 month ago

Indicators of compromise added (6)

Indicators of compromise recorded
1 Jun 2026 15:34 UTC about 2 months ago

1 Jun 2026 15:34 UTC · about 2 months ago

Nuclei template available

Scanner coverage available
3 Feb 2026 14:35 UTC 6 months ago

3 Feb 2026 14:35 UTC · 6 months ago

CVE published

Vulnerability disclosed publicly
19 Jan 2026 20:14 UTC 6 months ago

19 Jan 2026 20:14 UTC · 6 months ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-1207

{
  "cve_id": "CVE-2026-1207",
  "title": "Potential SQL injection via raster lookups on PostGIS",
  "affected_vendor": "djangoproject",
  "affected_product": "Django",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 5.4,
  "epss_score": 0.09436,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-1207

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 39 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API