A high-severity SQL injection vulnerability in the Black Duck Coverity Connect SOAP API allows authenticated attackers to perform unauthorized database operations.

This is a SQL injection vulnerability (CWE-89) located within the SOAP API. An authenticated attacker (PR:L) can inject malicious SQL fragments, leading to unauthorized data access, modification, or potential full database compromise.

The ability to perform SQL injection against a security-critical application like Coverity Connect presents a severe business risk. An attacker could extract sensitive project data or manipulate security scan results, effectively undermining the security posture of the entire development lifecycle. The CVSS 4.0 score of 8.7 highlights the critical nature of this vulnerability.

Immediate Action: Apply the vendor-provided patch by upgrading to version 2026.6.0 or the latest available version immediately.

Proactive Monitoring: Enable database query logging and monitor for unusual query structures or unauthorized attempts to access system tables within the Coverity database.

Compensating Controls: Restrict API access to trusted segments and ensure that database service accounts follow the principle of least privilege to limit the impact of potential SQL injection.

Public Exploit Available: false

Organizations using Coverity Connect must prioritize this upgrade. SQL injection vulnerabilities in core development infrastructure have the potential to cause significant damage to the confidentiality and integrity of source code and security metadata.