CVE-2024-42361: Apache Hertzbeat

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.

Affected products

• Apache Hertzbeat: before 1.6.0 (fixed in 1.6.0)

Published 2024-08-20. Last modified 2026-06-17.