What is CVE-2026-21856?

CVE-2026-21856 is a high-severity vulnerability in Tarkov Data Manager, classified under SQL Injection. CVSS score: 7.2/10. Published 2026-01-07.

How severe is CVE-2026-21856?

High severity. CVSS v3 base score is 7.2 out of 10.

SQL Injection in Tarkov Data Manager

CVE-2026-21856

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time based blind SQL injection vulnerability in the webhook edit and scanner api endpoints that allow an authenticated attacker to execute arbitrary SQL queries against the MySQL database. Commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8 contains a patch.

Vulnerability class: SQL Injection

EPSS: 0.003 (26.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tarkov Tarkov_data_manager
The-hideout Tarkov-data-manager — versions <= 2.0.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-21856?: CVE-2026-21856 is a high-severity vulnerability in Tarkov Data Manager, classified under SQL Injection. CVSS score: 7.2/10. Published 2026-01-07.
How severe is CVE-2026-21856?: High severity. CVSS v3 base score is 7.2 out of 10.