A second‑order SQL injection flaw exists in Hibernate’s InlineIdsOrClauseBuilder component. An attacker who can submit specially crafted, non‑alphanumeric input into the ID column can cause the application to execute unintended SQL commands. This can expose sensitive system files or application data, permit unauthorized data modification or deletion, and ultimately lead to an application‑level denial of service. The vulnerability is classified as CWE‑89 and attained a CVSS score of 8.3, indicating high severity.

The issue affects several Red Hat products that embed the vulnerable Hibernate core, including Red Hat AMQ Broker 7, Red Hat Data Grid 8, Red Hat Fuse 7, multiple versions of Red Hat JBoss Enterprise Application Platform (7.x and 8), Red Hat OpenShift AI and Dev Spaces, Red Hat Process Automation 7, Red Hat Satellite 6, Red Hat Single Sign‑On 7, and the Red Hat build of OptaPlanner 8. Affected versions are those listed in the CNA errata (RHSA‑2026:4915 through RHSA‑2026:6012).

With a CVSS score of 8.3 and an EPSS score of < 1%, the vulnerability poses a high risk, but the probability of exploitation remains very low. A remote attacker with only low privileges could trigger it over the network by submitting crafted input to a specific API or web form that passes unsanitized values to Hibernate. Because the product set is broad and widely deployed in enterprise environments, the impact could be significant if the defect is not remediated. The vulnerability is not listed in the CISA catalog.