A warning was published about a flaw in likaia NginxPulse

2026-11-13

KROMSE explanation

likaia NginxPulse has a critical security flaw (CVE-2026-129171, CVSS 9.3). The official record says: NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type.

No confirmed attacks and no public attack code yet.

Anyone running likaia NginxPulse older than 1.6.26.

Update likaia NginxPulse to 1.6.26 or later.
Not sure if you use it? KROMSE can check your product for free.

KROMSELive threat centreSign inAdd your repository or website to see if it impacts youAdd repo or website

A warning was published about a flaw in likaia NginxPulse

KROMSE explanation

Loading the story…