Is your Tianji instance vulnerable to SQL injection via timezone header?

The short version

• Tianji versions before 1.31.29 contain a critical SQL injection flaw.
• The vulnerability exists in the getDateQuery() function within the server utilities.
• Any authenticated workspace member, including read-only viewers, can trigger the exploit.

The details

Tianji is an open-source platform for analytics, uptime monitoring, and server status. According to the National Vulnerability Database record for CVE-2026-55239, versions prior to 1.31.29 suffer from a high-severity vulnerability rated at 8.8. The issue stems from the getDateQuery() function located in src/server/utils/prisma.ts. This function constructs raw SQL queries using Prisma.sql() by interpolating the timezone request value. Crucially, it fails to use parameter binding for this input.

The timezone value can reach these affected analytics queries through standard request data or via the timezone HTTP header. The workspaceProcedure in the application permits any authenticated workspace member to access these queries. This includes users with read-only viewer permissions. An attacker can leverage this access to execute arbitrary SQL commands against the shared PostgreSQL database. Such actions can disclose or modify sensitive information, including credentials, API keys, and tenant data. The attack may also render the service unavailable. The vendor has released version 1.31.29, which fixes this issue.

The context

The weakness is classified under CWE-89, which covers SQL injection vulnerabilities. The NVD record notes that the flaw allows for the execution of arbitrary SQL. This is particularly dangerous because the database is shared across tenants. Compromise of one instance could potentially expose data belonging to other users within the same deployment. The ability of read-only users to trigger the exploit widens the attack surface significantly.

Next steps

Teams should immediately inventory their Tianji installations. Verify the current version number against the affected range. If the version is below 1.31.29, plan an upgrade to the patched release. Monitor database logs for unusual query patterns from authenticated users. Ensure that all workspace members, including viewers, are accounted for in access reviews.

What defenders should look for

Security operations teams should monitor database audit logs for complex or unexpected SQL queries originating from application users. Look for queries that do not match standard application patterns or contain unusual syntax. Alert on authentication events followed immediately by database access from low-privilege accounts. Check for spikes in database resource usage or error rates, which may indicate injection attempts. Isolate affected instances if anomalous activity is confirmed to prevent lateral movement or data exfiltration. Review HTTP headers for manipulated timezone values in request logs.

What to do and how to stay safe: Tianji

• Audit all Tianji installations to confirm the software version is 1.31.29 or higher.
• Review database logs for unusual SQL queries or access patterns from read-only users.
• Restrict access to the timezone HTTP header if possible until patches are applied.
• Monitor for signs of data exfiltration or unauthorized modifications to tenant data.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Tianji are affected by this SQL injection flaw?

All versions of Tianji prior to 1.31.29 are affected by CVE-2026-55239.

Can a read-only user exploit this vulnerability?

Yes, the workspaceProcedure permits any authenticated workspace member, including read-only viewers, to reach the affected queries.

What is the CVSS score for CVE-2026-55239?

The National Vulnerability Database rates CVE-2026-55239 as 8.8, which is classified as high severity.