Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query string (readers/api/http/transport.go) with no validation and in…

CVE-2026-71276 describes a SQL injection vulnerability in Magistrala (formerly Mainflux), an open-source IoT messaging platform. The message-readers API reads a 'format' parameter from the HTTP query string without any validation. This value is then directly interpolated into raw SQL queries using fmt.Sprintf() in both the PostgreSQL and TimescaleDB reader implementations. The vulnerable pattern allows an authenticated user to manipulate the SQL query by crafting a malicious 'format' value. Both readers/postgres/messages.go and readers/timescale/messages.go are affected with the same insecure pattern. Any authenticated user with access to the channel messages query endpoint can exploit this vulnerability. The issue stems from a lack of input sanitization and the use of string formatting instead of parameterized queries. This represents a classic and critical SQL injection flaw in a widely used IoT platform.