CVE-2026-49989
Received Received - Intake

Unauthenticated Blob Access in CrateDB

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways to access blob storage: SQL (`SELECT ... FROM blob.<table>` and friends) and the blob HTTP API (`GET|PUT|DELETE /_blobs/{table}/{digest}`). The SQL path goes through `AccessControl`, which is what enforces privilege grants; that's why `SELECT digest FROM blob.secret_blobs` fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks `AccessControl` whether the authenticated user is allowed to touch the table. So a user with no grants gets `MissingPrivilegeException` from SQL and `200 OK` plus the blob bytes from `GET /_blobs/secret_blobs/<digest>`. Deployments that don't use `BLOB TABLE` are unaffected. Authentication itself still works; the bug is strictly that being authenticated as anyone is treated as sufficient for any blob op. Versions 6.2.8 and 6.3.2 fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-49989
EUVD
EUVD-2026-58717

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cratedb cratedb to 6.3.2 (exc)
crate cratedb to 6.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49989 is a vulnerability in CrateDB where the Blob HTTP handler bypasses authorization checks. Any authenticated user can read or delete any blob if they know its SHA-1 digest, and upload new blobs without restrictions, regardless of granted permissions. This occurs because the HTTP Blob API does not enforce privilege checks unlike the SQL interface.

Detection Guidance

Check CrateDB versions with: curl -s http://localhost:4200/_nodes | grep version. If running versions before 6.2.8 or 6.3.2, the system is vulnerable. Monitor HTTP API access logs for unusual GET, PUT, or DELETE requests to /_blobs endpoints.

Impact Analysis

An attacker could exploit this to access or modify blobs they should not have permission to touch via HTTP API endpoints. While authentication is required, the flaw allows unauthorized blob operations if the digest is known. Deployments not using BLOB TABLE are unaffected.

Mitigation Strategies

Upgrade CrateDB to versions 6.2.8 or 6.3.2 or later immediately. Disable HTTP Blob API access if not required by configuring the server to restrict blob operations. Review and restrict user permissions to minimize potential exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49989. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart