CVE-2026-4104
A critical flaw in TeknoPass lets attackers inject SQL and bypass authorization. The vulnerability is present in all versions from 20210501 to 20260429 and can be exploited without any special access or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
TeknoPass Automation software, versions 20210501 through 20260429, used by businesses in the automation industry.
Real-world impact
An attacker who can reach the vulnerable input can run arbitrary SQL commands, read or modify sensitive data, and potentially take full control of the database.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network reachable, requires no authentication, and gives attackers complete confidentiality, integrity, and availability damage. The vector shows no need for user interaction and no privilege is required.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.