# CVE-2026-108742: CloudBeaver missing authorization in GraphQL initConnection mutation

Source: https://junglewise.ai/threats/cve-2026-108742-cloudbeaver-through-25-3-5-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108742 · Severity: medium · CVSS 4.3 · Published 2026-10-11

CloudBeaver is a cloud-based database management tool that allows teams to collaborate on database access and analysis. A missing authorization check in the initConnection GraphQL endpoint allows view-only project members to persist database credentials without proper permissions, letting attackers configure connections under their own identity for other users to leverage.

Technologies: [DBeaver CloudBeaver](https://junglewise.ai/threats/technologies/cloudbeaver). Vendors: [DBeaver](https://junglewise.ai/threats/vendors/dbeaver).

## Quick answers

**Is CVE-2026-108742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108742 being exploited in the wild.

**How severe is CVE-2026-108742?** Medium severity, with a CVSS score of 4.3, published 11 October 2026.

**Which products and versions are affected?** DBeaver CloudBeaver through 25.3.5.

**Is there a fix for CVE-2026-108742?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108742 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108742?** Check whether you run DBeaver CloudBeaver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The initConnection GraphQL mutation fails to enforce datasource-edit authorization checks before allowing saveCredentials and sharedCredentials flags to be set with arbitrary authProperties. An attacker with view-only shared-project access can exploit this to persist credentials and shared connection configurations, causing subsequent users connecting to the shared connection to authenticate under the attacker's database identity. This is a privilege escalation attack that enables lateral movement and credential theft in multi-tenant database environments.

## Affected products

- DBeaver CloudBeaver through 25.3.5

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/dbeaver/cloudbeaver](https://github.com/dbeaver/cloudbeaver)
- [https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java](https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java)

## Related threats

- [CloudBeaver data export restriction bypass](https://junglewise.ai/threats/cve-2026-63664-cloudbeaver-is-a-cloud-database-manager-in-versions-up-to-and)
- [CloudBeaver path traversal in SQL result-editing](https://junglewise.ai/threats/cve-2026-63663-cloudbeaver-is-a-cloud-database-manager-from-version-23-2-3-until)
- [CloudBeaver path traversal in project identifier resolution](https://junglewise.ai/threats/cve-2026-55449-cloudbeaver-is-a-cloud-database-manager-prior-to-26-1-2-its)