CVE-2026-49989

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49989
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49989.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49989
Aliases
Published
2026-08-14T16:29:17.485Z
Modified
2026-08-17T04:11:36.269709Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
CrateDB's Blob HTTP handler bypasses authorization
Details

CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL (SELECT ... FROM blob.<table> and friends) and the blob HTTP API (GET|PUT|DELETE /_blobs/{table}/{digest}). The SQL path goes through AccessControl, which is what enforces privilege grants; that's why SELECT digest FROM blob.secret_blobs fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks AccessControl whether the authenticated user is allowed to touch the table. So a user with no grants gets MissingPrivilegeException from SQL and 200 OK plus the blob bytes from GET /_blobs/secret_blobs/<digest>. Deployments that don't use BLOB TABLE are unaffected. Authentication itself still works; the bug is strictly that being authenticated as anyone is treated as sufficient for any blob op. Versions 6.2.8 and 6.3.2 fix the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49989.json"
}
References

Affected packages

Git / github.com/crate/crate

Affected ranges

Type
GIT
Repo
https://github.com/crate/crate
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c3b179076e6e277f75fa3b9f0d57a83807c50f3f
Introduced
a4f97e652ea38818439a74f4f507d9b734efb12f
Fixed
ced89b5fb4c9a43be11eeae302ce3f29c20ee74c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.2.8"
        },
        {
            "introduced": "6.3.0"
        },
        {
            "fixed": "6.3.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.0.6
0.0.7
0.0.8
0.1.0
0.1.1
0.10.1
0.10.2
0.11.0
0.11.1
0.11.2
0.11.3
0.12.0
0.13.0
0.13.1
0.13.2
0.14.0
0.15.0
0.15.1
0.16.0
0.17.0
0.17.1
0.17.2
0.17.3
0.18.1
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
0.2.0
0.2.1
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.21.0
0.21.1
0.22.0
0.22.1
0.22.2
0.23.1
0.23.2
0.24.0
0.25.0
0.26.0
0.27.0
0.28.0
0.29.0
0.3.0
0.31.0
0.32.0
0.32.1
0.32.2
0.33.0
0.34.0
0.35.0
0.35.1
0.35.2
0.35.3
0.35.4
0.36.0
0.36.2
0.36.3
0.37.0
0.37.1
0.38.0
0.39.0
0.4.0
0.41.0
0.42.0
0.43.0
0.45.0
0.46.0
0.47.0
0.49.0
0.5.0
0.6.0
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.9.0
0.9.1
0.9.2
2.*
2.2.0
2.3.0
2.3.1
2.3.2
3.*
3.0.0
3.0.1
3.1.0
3.2.0
4.*
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.4.0
4.5.0
4.6.0
4.7.0
4.8.0
5.*
5.0.0
5.1.0
5.10.0
5.2.0
5.3.0
5.9.0
6.*
6.0.0
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
6.2.7
6.3.0
6.3.1
Other
list

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49989.json"
vanir_signatures 
[
    {
        "target": {
            "file": "server/src/main/java/org/elasticsearch/Version.java"
        },
        "deprecated": false,
        "source": "https://github.com/crate/crate/commit/c3b179076e6e277f75fa3b9f0d57a83807c50f3f",
        "id": "CVE-2026-49989-9f83c321",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "270793349312344400368181043482502660781",
                "284134920773675491269929934793591327829",
                "162883390703555116086237459371138489052",
                "122454297257501859076834816162437969071"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "server/src/main/java/org/elasticsearch/Version.java"
        },
        "deprecated": false,
        "source": "https://github.com/crate/crate/commit/ced89b5fb4c9a43be11eeae302ce3f29c20ee74c",
        "id": "CVE-2026-49989-ac2ee3dc",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "265547119473240293035819336109679188223",
                "271005480872043049244134361285301666053",
                "258629449914037030957080884097767040823",
                "92779099112381429984845012201488891235"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-17T04:11:36Z"