CVE-2026-1207

CVE Enrichment

CVSS: 5.4 MEDIUM
EPSS: 12.82%
EPSS Percentile: 96.31%
CISA KEV: Not listed

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
Published: 03-Feb-2026 22:16
Last Modified: 15-Jul-2026 09:18
EPSS Date: 2026-11-05
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:L /
                            I:L /
                            A:N

CNA Products / Version Status

Red Hat · Red Hat Ansible Automation Platform 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:ansible_automation_platform:2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: ansible-automation-platform-24/de-minimal-rhel8
Red Hat · Red Hat Ansible Automation Platform 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:ansible_automation_platform:2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: ansible-automation-platform-24/de-minimal-rhel9
Red Hat · Red Hat Ansible Automation Platform 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:ansible_automation_platform:2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: ansible-automation-platform-25/de-minimal-rhel8
Red Hat · Red Hat Ansible Automation Platform 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:ansible_automation_platform:2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: ansible-automation-platform-25/de-minimal-rhel9
Red Hat · Red Hat Ansible Automation Platform 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:ansible_automation_platform:2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: ansible-automation-platform-26/de-minimal-rhel9
Red Hat · Red Hat Ansible Automation Platform 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

CPEs: cpe:/a:redhat:ansible_automation_platform:2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: automation-controller
Red Hat · Red Hat Ansible Automation Platform 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:ansible_automation_platform:2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.2.28-1.el8ap ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:ansible_automation_platform:2.5::el8

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python3.12-django
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.2.28-1.el9ap ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:ansible_automation_platform:2.5::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python3.12-django
Red Hat · Red Hat Ansible Automation Platform 2.5 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

1772214630 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:ansible_automation_platform:2.5::el8

collectionURL: https://catalog.redhat.com/software/containers/
packageName: ansible-automation-platform-25/lightspeed-rhel8
Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.2.28-1.el9ap ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:ansible_automation_platform:2.6::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python3.12-django
Red Hat · Red Hat Ansible Automation Platform 2.6 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

1772552788 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:ansible_automation_platform:2.6::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: ansible-automation-platform-26/lightspeed-rhel9
Red Hat · Red Hat Discovery 2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

1770913597 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:discovery:2::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: discovery/discovery-server-rhel9
Red Hat · Red Hat OpenStack Platform 16.2 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:openstack:16.2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django20
Red Hat · Red Hat OpenStack Platform 17.1 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:openstack:17.1

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django
Red Hat · Red Hat OpenStack Platform 18.0 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: unaffected

CPEs: cpe:/a:redhat:openstack:18.0

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django
Red Hat · Red Hat Satellite 6 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

CPEs: cpe:/a:redhat:satellite:6

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: satellite-capsule:el8/python-django
Red Hat · Red Hat Satellite 6.16 for RHEL 8 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.2.28-0.1.el8pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite:6.16::el8, cpe:/a:redhat:satellite_capsule:6.16::el8

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django
Red Hat · Red Hat Satellite 6.16 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.2.28-0.1.el9pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite:6.16::el9, cpe:/a:redhat:satellite_capsule:6.16::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:3.14.0.14-1.el9sat ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: foreman
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:0.1.23-0.3.el9pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: libcomps
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:1.2.0-0.1.el9pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-brotli
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.2.28-0.1.el9pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:2.22.3-1.el9pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-pulp-container
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:3.27.10-2.el9pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-pulp-rpm
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:1.5.1-1.el9sat ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rubygem-fog-kubevirt
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:0.4.3-1.el9sat ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rubygem-foreman_kubevirt
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.16.0.14-1.el9sat ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rubygem-katello
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:0.13.0-1.el9sat ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rubygem-rubyipmi
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:6.17.7-1.el9sat ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: satellite
Red Hat · Red Hat Satellite 6.17 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:0.0.3-4.el9sat ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite_maintenance:6.17::el9, cpe:/a:redhat:satellite_utils:6.17::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: yggdrasil-worker-forwarder
Red Hat · Red Hat Satellite 6.18 for RHEL 9 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

0:4.2.30-1.el9pc ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite:6.18::el9, cpe:/a:redhat:satellite_capsule:6.18::el9

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python3.12-django
Red Hat · Red Hat Satellite 6.18 Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

1773451075 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:satellite:6.18::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: satellite/iop-advisor-backend-rhel9
Red Hat · Red Hat Update Infrastructure 4 for Cloud Providers Source: CNA · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Default status: affected

CPEs: cpe:/a:redhat:rhui:4::el8

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-django
djangoproject · Django Source: CNA · 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
Default status: unaffected

6.0 ≤ version < 6.0.2 — affected (semver)
6.0.2 — unaffected (semver)
5.2 ≤ version < 5.2.11 — affected (semver)
5.2.11 — unaffected (semver)
4.2 ≤ version < 4.2.28 — affected (semver)
4.2.28 — unaffected (semver)

collectionURL: https://pypi.org/project/Django/
packageName: django
repo: https://github.com/django/django/

Affected Products / Versions

djangoproject / django Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.2 · before (exclusive) 4.2.28
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
djangoproject / django Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.2 · before (exclusive) 5.2.11
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
djangoproject / django Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.0 · before (exclusive) 6.0.2
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

References

Last enrichment sync: 06-Nov-2026 20:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-1207 — Django (High) Cyble Weekly Report Tracks 1,960 Vulnerabilities, Including PoC Exploits and Critical ICS Flaws

CVE (8)

MITRE ATT&CK (5)

Vendors (5)

Products (10)

Industries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.