CVE-2026-53448
published 2026-07-10CVE-2026-53448: Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into…
PriorityP350high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.70%
52.8th percentile
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated admin can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. This issue is fixed in version 4.12.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| coturn | coturn | < 4.12.0 | 4.12.0 |
| coturn_project | coturn | < 4.12.0 | 4.12.0 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
coturn: Coturn: Arbitrary code execution via SQL injection in HTTPS admin panel
vendor_redhat·2026-07-10·CVSS 7.2
CVE-2026-53448 [HIGH] CWE-89 coturn: Coturn: Arbitrary code execution via SQL injection in HTTPS admin panel
coturn: Coturn: Arbitrary code execution via SQL injection in HTTPS admin panel
A flaw was found in Coturn, a free open-source implementation of TURN and STUN Server. The HTTPS administration panel, specifically in the delete-user, delete-secret, and delete-IP operations, does not properly sanitize HTTP query parameters. This allows an authenticated administrator to inject arbitrary SQL (Structured Query Language) commands, leading to full control over the database. This could potentially enable an attacker to achieve arbitrary code execution on the underlying operating system.
Statement: This flaw affects the community-maintained coturn TURN/STUN server as shipped in Fedora and EPEL. Red Hat does not ship coturn in any core Red Hat product. Fedora and EPEL currently ship coturn 4.14.0,
VulDB
coturn up to 4.11.x Admin Panel du/ds/dip injection (Nessus ID 326461)
vuldb·2026-07-14·CVSS 7.2
CVE-2026-53448 [HIGH] coturn up to 4.11.x Admin Panel du/ds/dip injection (Nessus ID 326461)
A vulnerability was found in coturn up to 4.11.x. It has been rated as very critical. This impacts an unknown function of the component Admin Panel. The manipulation of the argument du/ds/dip leads to injection.
This vulnerability is listed as CVE-2026-53448. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
No public exploits indexed.
https://github.com/coturn/coturn/commit/b84dbab1d1aa6e2bf0211a1cdbb250d6de2a0d09https://github.com/coturn/coturn/pull/1924https://github.com/coturn/coturn/releases/tag/4.12.0https://github.com/coturn/coturn/security/advisories/GHSA-v8hj-2xx7-xmp5https://github.com/coturn/coturn/security/advisories/GHSA-v8hj-2xx7-xmp5
2026-07-10
Published