CVE-2026-49989 CrateDB's Blob HTTP handler bypasses authorization
Authenticated users can read, delete, or create blobs in any table via the HTTP API, bypassing SQL privilege checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49989?
CVE-2026-49989 is a high-severity missing authorization vulnerability in crate, published on 14 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways to access blob storage: SQL (`SELECT ... FROM blob.<table>` and friends) and the blob HTTP API (`GET|PUT|DELETE /_blobs/{table}/{digest}`). The SQL path goes through `AccessControl`, which is what enforces privilege grants; that's why `SELECT digest FROM blob.secret_blobs` fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks `AccessControl` whether the authenticated user is allowed to touch the table. So a user with no grants gets `MissingPrivilegeException` from SQL and `200 OK` plus the blob bytes from `GET /_blobs/secret_blobs/<digest>`. Deployments that don't use `BLOB TABLE` are unaffected. Authentication itself still works; the bug is strictly that being authenticated as anyone is treated as sufficient for any blob op. Versions 6.2.8 and 6.3.2 fix the issue.
Weakness: CWE-863
Which versions are affected by CVE-2026-49989?
4 open source packages ship an affected version, including io.crate:crate.
| Package | Affected | Fixed in |
|---|---|---|
io.crate:crate Maven | All versions | 6.2.8 |
io.crate:crate Maven | All versions | 6.2.8 |
io.crate:crate Maven | From 6.3.0 | 6.3.2 |
io.crate:crate Maven | From 6.3.0 | 6.3.2 |
How do I fix CVE-2026-49989?
Upgrade io.crate:crate to a fixed version for your release line: 6.2.8 or 6.3.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-49989 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49989 exists.
Sources
Also known as GHSA-2xv8-gjwh-fv8p.