{"id":"CVE-2026-49989","title":"CrateDB is a distributed SQL database","summary":"CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s…","severity":"low","cwe":["CWE-863"],"vendor":"crate","product":"io.crate:crate","affected":["io.crate:crate < 6.2.8","io.crate:crate >= 6.3.0, < 6.3.2"],"patched":["io.crate:crate 6.2.8","io.crate:crate 6.3.2"],"published":"2026-08-14","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49989","references":[{"url":"https://github.com/crate/crate/security/advisories/GHSA-2xv8-gjwh-fv8p","label":"security-advisories@github.com"},{"url":"https://github.com/crate/crate/security/advisories/GHSA-2xv8-gjwh-fv8p","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-2xv8-gjwh-fv8p"}],"tags":["nvd","ghsa","maven"],"epss":0.00333,"epssPercentile":0.267,"ecosystem":"maven","ingestedAt":"2026-07-01T20:16:35.288Z","slug":"CVE-2026-49989","body":"## Overview\n\nCrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways to access blob storage: SQL (`SELECT ... FROM blob.<table>` and friends) and the blob HTTP API (`GET|PUT|DELETE /_blobs/{table}/{digest}`). The SQL path goes through `AccessControl`, which is what enforces privilege grants; that's why `SELECT digest FROM blob.secret_blobs` fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks `AccessControl` whether the authenticated user is allowed to touch the table. So a user with no grants gets `MissingPrivilegeException` from SQL and `200 OK` plus the blob bytes from `GET /_blobs/secret_blobs/<digest>`. Deployments that don't use `BLOB TABLE` are unaffected. Authentication itself still works; the bug is strictly that being authenticated as anyone is treated as sufficient for any blob op. Versions 6.2.8 and 6.3.2 fix the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49989)\n\nAffected packages:\n\n- `io.crate:crate < 6.2.8`\n- `io.crate:crate >= 6.3.0, < 6.3.2`\n\nPatched in:\n\n- `io.crate:crate 6.2.8`\n- `io.crate:crate 6.3.2`\n\nSource: https://github.com/advisories/GHSA-2xv8-gjwh-fv8p","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}