CVE-2026-49989: CrateDB authorization bypass in Blob HTTP handler

CVE-2026-49989 · Severity: low · CVSS 3.1 · Published 2026-07-01

CrateDB, a distributed SQL database, contains a security flaw in how it handles large file storage (blobs) via its web interface. While the database correctly restricts access when using standard database commands, it fails to check permissions when files are accessed directly via web links. This allows any registered user to read or delete files they shouldn't have access to, provided they know the file's unique identifier, and allows them to upload new files without restriction.

Technologies: io.crate:crate (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-49989 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49989 being exploited in the wild.
How severe is CVE-2026-49989?
Low severity, with a CVSS score of 3.1, published 1 July 2026.
Which products and versions are affected?
Crate.io CrateDB < 6.2.8, >= 6.3.0, < 6.3.2; io.crate:crate (Maven) ECOSYSTEM:introduced=0,fixed=6.2.8.
Is there a fix for CVE-2026-49989?
Yes. io.crate:crate (Maven): upgrade to 6.2.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49989 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49989?
Check whether you run Crate.io CrateDB or io.crate:crate (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.crate:crate (Maven): upgrade to 6.2.8 or later
    # set io.crate:crate to 6.2.8 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the `io.crate.protocols.http.HttpBlobHandler` component of CrateDB. While the SQL interface correctly utilizes `AccessControl` to enforce privileges, the HTTP API (`/_blobs/{table}/{digest}`) authenticates requests but fails to verify if the authenticated user has the necessary DQL (for GET/HEAD) or DML (for PUT/DELETE) permissions on the target blob table. An attacker with valid credentials can read or delete any blob if they know its SHA-1 digest, and can upload new blobs to any table regardless of assigned privileges. The issue is resolved in versions 6.2.8 and 6.3.2 by integrating `AccessControl` checks into the HTTP request dispatcher.

Affected products

  • Crate.io CrateDB < 6.2.8, >= 6.3.0, < 6.3.2

Identifiers

  • CVE-2026-49989
  • GHSA-2xv8-gjwh-fv8p

Timeline

  • 2026-05-27: disclosed: Initial advisory publication
  • 2026-07-01: advisory: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.