CVE-2026-15043 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-15043 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-15043 is a logic flaw in DBI::SQL::Nano, the built-in mini-SQL engine included with the Perl DBI module, affecting versions 1.42 through 1.650, where SQL comparison operators for text values are evaluated in reverse.

Technical Detail

The flaw stems from an inverted implementation of the less-than-or-equal and greater-than-or-equal operators when evaluating WHERE clause predicates against text data, causing queries to return the opposite of the intended result set. An attacker or application logic that relies on these comparisons for access control, filtering, or data validation may receive incorrect query results, potentially exposing records that should be excluded or suppressing records that should be returned. Depending on how the affected application uses DBI::SQL::Nano for authorization or data gating, this could result in unauthorized data access or effective authentication bypass in contexts where SQL filtering enforces access decisions.

Exploitation Status

No known exploit exists for this vulnerability at this time. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been identified. The CVSS score of 9.8 reflects the theoretical severity of the logic inversion rather than observed exploitation activity.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability as of the date of this briefing.

What To Do

Upgrade DBI::SQL::Nano to version 1.651 or later, which corrects the operator inversion. Administrators should audit any Perl applications that use DBI::SQL::Nano for text-based WHERE clause comparisons involving the less-than-or-equal or greater-than-or-equal operators, particularly in access control or data filtering logic, as prior query results may have been incorrect. Applications using full database backends such as PostgreSQL, MySQL, or SQLite through DBI are not affected by this flaw, as DBI::SQL::Nano is only invoked when no external database driver handles the query. If immediate patching is not possible, review and validate any application logic that depends on text comparison results from this component and consider adding compensating controls at the application layer.