CVE-2026-49989 - CrateDB's Blob HTTP handler bypasses authorization
Brief
CVE ID : CVE-2026-49989
Published : Aug. 14, 2026, 4:29 p. m.
- 36 minutes ago
Description : CrateDB is a distributed SQL database. Prior to versions 6.
- 8 and 6.
- 2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways to access blob storage: SQL (`SELECT ... FROM blob. ` and friends) and the blob HTTP API (`GET
- PUT
- DELETE /_blobs/{table}/{digest}`). The SQL path goes through `AccessControl`, which is what enforces privilege grants; that's why `SELECT digest FROM blob.secret_blobs` fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks `AccessControl` whether the authenticated user is allowed to touch the table.