6

CVE-2026-1207 is a classic string-concatenation SQLi (CWE-89) in Django's GIS raster lookup path. When an application uses RasterField on PostGIS and passes a user-controlled *band index* into a raster lookup, Django inlines that integer into the generated SQL rather than binding it as a parameter. An authenticated user who controls that value can break out of the intended position and inject arbitrary SQL against the backing PostgreSQL/PostGIS database. Fixed versions are 6.0.2, 5.2.11, and 4.2.28, all shipped 2026-02-03; older unsupported branches (3.2.x, 4.1.x, 5.0.x) were not evaluated but are known-vulnerable per HeroDevs, which shipped a backport for 3.2.27.

The vendor's MEDIUM/5.4 rating leans on the PR:L and C:L/I:L scope — authenticated, partial impact. That framing understates two things: (1) SQLi against a production PostGIS instance is *rarely* actually partial — union-based extraction and second-order writes routinely escalate to full schema egress and tampering; (2) CrowdSec confirmed in-the-wild exploitation from 2026-02-26 onward, with sustained week-over-week scanning of /?band= and /api/raster/search/?band= patterns. Vendor severity does not match reality — this belongs in the HIGH bucket for any org actually running GeoDjango + PostGIS.

Why this verdict

• Active exploitation: CrowdSec confirmed real attack traffic from 2026-02-26 — this is no longer theoretical.
• Impact underscored: SQLi against PostGIS with the Django app's DB role rarely stays 'partial' — union-based reads escalate to session/credential theft, which is why EPSS is already ~9.4%.
• Role multiplier: The affected component is a Django *application tier* speaking to a *production database* — the blast radius from a successful chain is fleet-scale within the tenant (all rows accessible to the app user), and Django is one of the most widely deployed Python web frameworks. Not identity/hypervisor tier, but data-tier compromise plausibly ends in mass PII/credential egress.
• Friction limiting upgrade to CRITICAL: PR:L requires authenticated access, and the vulnerable code path is only reachable in apps using GeoDjango + PostGIS + RasterField with user-controlled band index — a small fraction of Django's installed base.
• Deployment-role floor: Django apps hosting regulated/PII data on PostgreSQL are canonically 'production database' tier. Any org running GeoDjango + PostGIS for real (geospatial platforms, insurance/agri/logistics analytics) hits the HIGH floor by role.

Why not higher?

CRITICAL requires either unauthenticated exploitation, a canonical high-value-role component (hypervisor/IdP/PAM/DC), or KEV listing. This CVE requires PR:L, the vulnerable code path is a niche feature, and CISA has not yet added it. Also, well-configured deployments already coerce band index via IntegerField in serializers, which entirely neutralizes the payload.

Why not lower?

MEDIUM undersells two facts: exploitation is *actively happening in the wild*, and the impact vector is SQLi against a production database — that outcome rarely stays partial once an attacker enumerates the schema. Any framework tracking real-world signals (EPSS ~9.4%, CrowdSec traffic) pushes this past MEDIUM.

1. Coerce band index to int at the view/serializer boundary — Wrap every raster lookup input with DRF IntegerField / Django forms.IntegerField or an explicit int() cast with a validated range. This kills the payload before it reaches the ORM. Deploy within 30 days per noisgate mitigation SLA — same day if you can identify the endpoints.
2. Deploy a WAF rule blocking non-integer values on band and adjacent raster params — Signature: reject any band (or similarly-named) parameter that doesn't match ^-?\d{1,3}$. F5, Cloudflare, AWS WAF, and ModSecurity CRS can all express this. Buys you time until the Django upgrade lands.
3. Rotate the Django app's PostgreSQL role to least privilege — The app user should have no pg_read_server_files, no COPY FROM PROGRAM, and only SELECT/INSERT/UPDATE on its own schema. Row-level security on tables holding PII/tokens caps the blast radius even if SQLi lands.
4. Enable log_statement='mod' or full statement logging on PostgreSQL for the app role — Feeds a SIEM detection for UNION SELECT, information_schema.tables reads, and pg_user reads originating from the Django app user.
5. Rotate session keys and force reauth if you detect probes — If CrowdSec/WAF logs show real band-parameter injection attempts, assume session-cookie exfil and rotate SECRET_KEY + invalidate all sessions.

Run on any host that has your Django project's requirements.txt / poetry.lock / installed venv. Invoke as python check_cve_2026_1207.py /path/to/venv/bin/python (pass the interpreter of the environment you want to test) or omit the arg to test the current interpreter. No elevated privileges required.

#!/usr/bin/env python3
# noisgate — CVE-2026-1207 detector (Django GIS RasterField SQLi)
# Exits 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
import subprocess, sys, re

FIXED = {
    (4, 2): (4, 2, 28),
    (5, 2): (5, 2, 11),
    (6, 0): (6, 0, 2),
}

def get_django_version(py):
    try:
        out = subprocess.check_output(
            [py, '-c', 'import django,sys;sys.stdout.write(django.get_version())'],
            stderr=subprocess.STDOUT, timeout=10).decode().strip()
        return out
    except Exception as e:
        print(f'UNKNOWN: could not import django ({e})')
        sys.exit(2)

def parse(v):
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())

def main():
    py = sys.argv[1] if len(sys.argv) > 1 else sys.executable
    ver = get_django_version(py)
    parsed = parse(ver)
    if not parsed:
        print(f'UNKNOWN: unparseable Django version {ver}')
        sys.exit(2)
    major, minor, patch = parsed
    # Unsupported branches (3.2, 4.1, 5.0) are vulnerable unless HeroDevs NES applied
    if (major, minor) in [(3, 2), (4, 1), (5, 0)]:
        print(f'VULNERABLE: Django {ver} is on an unsupported branch; upstream did not evaluate. See HeroDevs NES for 3.2.')
        sys.exit(1)
    fixed = FIXED.get((major, minor))
    if fixed is None:
        print(f'UNKNOWN: Django {ver} branch not in fix table')
        sys.exit(2)
    if parsed >= fixed:
        print(f'PATCHED: Django {ver} >= {".".join(map(str, fixed))}')
        sys.exit(0)
    print(f'VULNERABLE: Django {ver} < {".".join(map(str, fixed))} — CVE-2026-1207')
    sys.exit(1)

if __name__ == '__main__':
    main()

Sources

1. GitHub Advisory GHSA-mwm9-4648-f68q
2. HeroDevs — CVE-2026-1207 technical writeup
3. CrowdSec — Active exploitation report
4. Red Hat Bugzilla 2436338
5. SentinelOne vulnerability database
6. OffSeq Threat Radar entry
7. CVEFeed detail
8. Django security policy