PT-2026-55217 · Crate+2 · Crate+1
CVE-2026-49989
·
Published
2026-07-01
·
Updated
2026-08-14
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
CrateDB versions prior to 6.2.8
CrateDB versions prior to 6.3.2
Description
An authorization bypass exists in the blob HTTP API of CrateDB. While the SQL path for accessing blob storage correctly enforces privilege grants via
AccessControl, the HTTP path only authenticates the request without verifying if the authenticated user has the necessary permissions to access the specific table. Consequently, any authenticated user who knows the SHA-1 digest of a blob can read or delete it, and can upload new blobs to any blob table regardless of assigned grants. This issue is present in the io.crate.protocols.http.HttpBlobHandler component, specifically within the handleBlobRequest() function, which fails to perform privilege checks before executing blob operations.API Endpoints:
GET|PUT|DELETE / blobs/{table}/{digest}Recommendations
Update CrateDB to version 6.2.8 or later.
Update CrateDB to version 6.3.2 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Crate
Io.Crate:Crate