PT-2026-55217 · Crate+2 · Crate+1

CVE-2026-49989

·

Published

2026-07-01

·

Updated

2026-08-14

CVSS v4.0

7.1

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions CrateDB versions prior to 6.2.8 CrateDB versions prior to 6.3.2
Description An authorization bypass exists in the blob HTTP API of CrateDB. While the SQL path for accessing blob storage correctly enforces privilege grants via AccessControl, the HTTP path only authenticates the request without verifying if the authenticated user has the necessary permissions to access the specific table. Consequently, any authenticated user who knows the SHA-1 digest of a blob can read or delete it, and can upload new blobs to any blob table regardless of assigned grants. This issue is present in the io.crate.protocols.http.HttpBlobHandler component, specifically within the handleBlobRequest() function, which fails to perform privilege checks before executing blob operations.
API Endpoints: GET|PUT|DELETE / blobs/{table}/{digest}
Recommendations Update CrateDB to version 6.2.8 or later. Update CrateDB to version 6.3.2 or later.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-49989
GHSA-2XV8-GJWH-FV8P

Affected Products

Crate
Io.Crate:Crate