A high-severity SQL injection vulnerability in the Anchore Enterprise GraphQL Reports API allows authenticated attackers to modify sensitive database records.

This flaw is a CWE-89 SQL injection vulnerability located in the GraphQL Reports API. An attacker with authenticated access to the API can execute arbitrary SQL instructions against the backend database.

Successful exploitation of this vulnerability permits unauthorized modification of data within the Anchore Enterprise database, potentially compromising the integrity of security policies, image analysis results, or user configurations. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the development and security pipeline. Unauthorized database access could lead to the bypass of supply chain security controls or the manipulation of audit trails.

Immediate Action: Upgrade Anchore Enterprise to version 5.25.1 or later as specified in the official vendor release notes.

Proactive Monitoring: Review GraphQL API access logs for anomalous query patterns or unusual SQL syntax, particularly those originating from unauthorized or unexpected user accounts.

Compensating Controls: Implement strict network access control lists to limit access to the GraphQL API to known, trusted administrative endpoints.

Public Exploit Available: Unknown

This vulnerability presents a critical threat to the integrity of the Anchore Enterprise platform by allowing unauthorized database modifications. Organizations should treat this as a priority update and deploy version 5.25.1 immediately to eliminate the underlying SQL injection flaw. Failure to remediate could allow an attacker to compromise the integrity of the software supply chain data managed by the platform.