Executive brief
Databend, an open-source cloud data warehouse, is vulnerable to an authorization bypass that could allow users from one organization to access data belonging to another. This occurs because the system fails to properly separate temporary session data between different tenants if they happen to use identical usernames and session IDs. An attacker could potentially view or reuse sensitive temporary table data from a different customer, leading to unauthorized data exposure.
Technical details
A vulnerability in Databend's ClientSessionManager::state_key function (src/query/service/src/servers/http/v1/session/client_session_manager.rs) leads to an authorization bypass via session state key collision. The root cause is that the in-memory session state key for HTTP sessions is constructed using only the username and client session ID, omitting the tenant identifier. If two different tenants use the same username and session ID, their requests map to the same server-side state entry. This allows an attacker to potentially access or reuse temporary table metadata and data belonging to another tenant. The issue is exploitable remotely by an authenticated user. A fix has been merged into the main branch to include tenant scoping in the session state keys.
Affected products
- Databend Databend up to 1.2.881
Timeline
- 2026-05-27: disclosed: Issue and PR opened on GitHub
- 2026-06-28: patched: Pull request merged into main branch
- 2026-06-28: advisory: CVE published