Executive brief
MyScaleDB, a database optimized for AI and vector search, contains a flaw where updating data does not correctly refresh its search index. This can cause the database to return outdated or incorrect results for search queries, even after the underlying data has been changed. In practice, this could lead to security-sensitive applications, such as recommendation engines or automated deduplication systems, making decisions based on stale and inaccurate information.
Technical details
A vulnerability in MyScaleDB (up to version 1.8.0) exists in the vector indexing mechanism, specifically within SegmentId::getCacheKey in src/VectorIndex/Common/SegmentId.h. When an ALTER TABLE ... UPDATE command modifies a vector-indexed column, the system may reuse old vector index files (.vidx) and in-memory cache identities instead of rebuilding them. This occurs because the cache key generation logic (cutMutVer) strips mutation suffixes, causing mutated parts to alias the original part's cache component. An attacker with network access and low privileges could potentially exploit this to ensure stale data is served in response to vector search queries. A fix has been proposed in Pull Request #55 which ensures updated vector columns are marked for rebuild and prevents hardlinking of old index files during mutations.
Affected products
- MyScale MyScaleDB up to 1.8.0
Timeline
- 2026-05-27: disclosed: Issue and fix reported via GitHub issue #54 and PR #55
- 2026-06-29: advisory: CVE-2026-13513 published by NVD/VulDB