StableN/ASyncedN/A

SQL Injection Security Vulnerability

Updated Jan 23, 2026275 viewsView on usehalo.com

This article contains details relating to the SQL Injection vulnerability affecting various versions of Halo.

This security update addresses an issue that could allow malicious actors to execute unauthorised database queries by supplying a carefully constructed payload.  

The vulnerability was found and reported by a 3rd party Security Research team, and there is no evidence of any exploit in our cloud-hosted environment or for a selection of On-Prem customers that we have worked with.

Hosted customers have been automatically updated to a patch to resolve this issue, and therefore no action is required by hosted customers. 

Halo On-Prem installations should apply the latest patch based on their chosen release channel.

  • Stable: Patched in version 2.174.94  
  • Candidate:  Patched in version 2.184.23  
  • Beta: Patched in version 2.186.2  

Details of the issue

The vulnerability is specifically exploited via the '/api/Notify' endpoint, whereby pre-authenticated SQL Injection can be executed as part of interacting with the relevant code for the 'LogMeIn Rescue' integration.

Remediation Actions

After the exploit was reported to Halo, all hosted environments were upgraded to relevant patches approximately 6 hours after the initial report was raised. Hosted environments have been checked for instances of exploits, and no evidence of such occurrences has been found.

Communications have been sent to On-Prem customers advising that they upgrade to one of the above patches as soon as possible, highlighting the importance of prioritising such a patch due to security concerns.

Next Steps

No action is required on the part of our hosted customers.

We will continue to monitor our hosted infrastructure to ensure the same level of service and security that you expect.

The DevOps team is currently performing a complete code audit for any unauthenticated endpoints, as well as requesting that our contracted 3rd party attack surface/vulnerability management partners perform additional code audits.

This particular instance was using a function of our application that is no longer in use for newly submitted changes.

Full details will be shared by the 3rd party vulnerability management team shortly.