CVE-2026-101010: BaoTa Panel: SQL injection in log_type via getData

aaPanel BaoTa up to 11.8.0 contains a SQL injection in the getData function of data.py, where the log_type argument is not sanitized, and the vendor has not responded to the disclosure so no patch exists. The CVSS score is a modest 4.7 because it requires high privileges (an authenticated panel admin), and the EPSS score of 0.00249 puts it in the top 85th percentile, so exploitation is plausible but not imminent. It is not in CISA KEV and CISA SSVC rates it TRACK*, but a public exploit gist is referenced, which lowers the bar for attackers who already hold panel credentials. This is a general server-management panel, not a core AI component, so it matters mainly where it hosts or administers ML UIs or model servers. Restrict panel access to trusted IPs or a VPN, rotate admin credentials, and monitor for SQL errors or odd log_type values until the vendor ships a fix.

Proof-of-concept exploit code is publicly available for CVE-2026-101010, increasing the risk of exploitation.

1) No vendor patch is available for 11.8.0 and earlier, so check the vendor channel for updates and apply any fix as soon as it ships. 2) Restrict BaoTa panel access to a VPN or allowlisted IPs and never expose it to the internet. 3) Enforce strong, unique admin credentials and MFA where possible, and rotate them. 4) Review panel accounts and remove unneeded privileged users. 5) Put a WAF in front of the panel with SQL injection rules for the log_type parameter. 6) Monitor panel and database logs for SQL syntax errors, UNION or time-based payloads, and unusual getData requests. 7) Separate AI/ML workloads from hosts managed by the panel where feasible.

This vulnerability affects the following AI/ML architecture patterns: Server management panels hosting ML web UIs, Model serving hosts administered via web panel, Self-hosted AI application servers.

CVE-2026-101010 has a CVSS v3.1 base score of 4.7 (MEDIUM). The EPSS exploitation probability is 0.25%.