CVE-2021-31856: Layer5 Meshery REST API SQL injection via order parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8 and very high EPSS makes this an urgent patch target despite no KEV listing.

What it is

Layer5 Meshery 0.5.2 contains a SQL injection flaw in its REST API, specifically in the order parameter handled by GetMesheryPatterns in models/meshery_pattern_persister.go. An unauthenticated remote attacker can inject arbitrary SQL through the /experimental/patternfiles endpoint, which matters because the database backing the API can be read or modified directly.

Impact

An attacker can execute arbitrary SQL commands against the Meshery database, gaining full read and write access to stored data and potentially compromising the underlying database server. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network through the /experimental/patternfiles REST endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any host that can reach the Meshery API can attempt the injection.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.754 (99.5th percentile), indicating strong predicted exploitation activity. The only references are the vendor patch PR and product page, with no public exploit or PoC tag supplied.

What to do

• Upgrade Meshery past 0.5.2 using the fix in layer5io/meshery pull request 2745.
• Do not expose the Meshery REST API, especially /experimental/patternfiles, to untrusted networks; restrict it to trusted management networks or a VPN.
• Apply parameterized queries or strict allow-listing for the order parameter if any custom or forked code remains.
• Run the Meshery database account with least privilege so injected SQL cannot reach unrelated schemas or perform administrative actions.
• Monitor and log API requests to the patternfiles endpoint for anomalous order parameter values.

Detection

• Inspect Meshery API access logs for requests to /experimental/patternfiles with SQL metacharacters, UNION, comment markers or boolean expressions in the order parameter.
• Alert on database errors or unusual query patterns originating from the Meshery service account.
• Baseline normal order parameter values and flag deviations or unusually long parameter strings.
• Watch for unexpected reads or writes to Meshery database tables that do not correlate with normal UI or API usage.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.