A SQL injection flaw exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 inclusive. An attacker who has legitimate authentication to the SOAP endpoint can craft a malicious payload that bypasses normal query handling, allowing unrestricted read access to the underlying database and the execution of other unintended commands. This can lead to extraction of sensitive data and potentially further compromise of the affected system.

Black Duck’s Coverity Connect is affected for all releases from 2024.6.0 through 2026.3.0 inclusive. Any deployment of the product within this range is exposed until a newer, non‑affected version is installed or the vulnerability is mitigated through configuration changes.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% shows a very low but nonzero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, meaning it has not yet been widely exploited. The attack vector is inferred to be a network‑based attack against the SOAP API endpoint, with the prerequisite of valid authentication. Once authenticated, the attacker can submit specially crafted requests that trigger the injection and result in data exfiltration or command execution.