CVE-2026-13513 MyScale MyScaleDB SegmentId.h getCacheKey data authenticity
Attackers can bypass data authenticity checks in MyScaleDB's cache key generation, potentially compromising data integrity or confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13513?
CVE-2026-13513 is a low-severity vulnerability in MyScaleDB, published on 28 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects the function SegmentId::getCacheKey in the library src/VectorIndex/Common/SegmentId.h. The manipulation results in insufficient verification of data authenticity. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Weakness: CWE-345
Which versions are affected by CVE-2026-13513?
How do I fix CVE-2026-13513?
No fix has been published for CVE-2026-13513 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13513 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-13513 exists.
Sources
Also known as GHSA-q6r3-vph9-qrqg.