fts-monitoring /linkinfo SQL injection exposes cloud storage credentials

A web monitoring tool can leak your cloud storage access keys.

Summary

An SQL injection flaw in the /linkinfo endpoint of FTS3 Web Monitoring (fts-monitoring) lets an unauthenticated remote attacker read stored cloud storage credentials and token provider client secrets. Versions 3.12.0 through 3.13.2 and 3.14.0 are affected.

What to do

Update 3.12.0 through 3.13.2 to 3.13.3, and 3.14.0 to 3.14.1.

Update to at least the version for your product:

fts-monitoring 3.13 line 3.13.3 or later
fts-monitoring 3.14 line 3.14.1 or later

Products and platforms

fts-monitoring

CVE IDs

CVE-2025-71458 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: advisories.egi.eu (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 00:20 UTC

First seen 2026-11-09 17:20 UTC