CVE-2026-13512
Databend Tenant client_session_manager.rs state_key authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 28, 2026
- Updated
- Jun 30, 2026
- Reserved
- Jun 28, 2026
Description
A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Databendn/a |
|
References
- VDB-374520 | Databend Tenant client_session_manager.rs state_key authorizationvdb-entrytechnical-description
- VDB-374520 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-13512 | CVE Analysis and Reportthird-party-advisory
- Submit #838874 | Databend Labs Databend main branch commit 21377cd76bb1e84f92bfc9da1acc881b8841f1de; affected versions unknown CWE-639 Authorization Bypass Through User-Controlled Keythird-party-advisory
- https://github.com/databendlabs/databend/issues/19930exploitissue-tracking
- https://github.com/databendlabs/databend/pull/19931issue-trackingpatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.