CloudBeaver CVE-2026-108745

Requires a valid CloudBeaver web session at any privilege level (PR:L), and the deployment must actually use the shared LOB-export folder served by WebSQLResultServlet. The attacker must additionally know or correctly guess the victim's table and column names AND enumerate the second-resolution timestamp used in the export filename to reconstruct a valid path - this enumeration/guessing requirement (reflected as AT:P) is the primary practical limiter. Exploitation is further bounded to data that victims have actually exported as LOB values; it leaks confidentiality only (no modification or DoS), and its real impact is greatest in multi-tenant instances shared by untrusted users.

All quantitative signals point to genuinely LOW real-world risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N) scores only 2.3: network-reachable but requiring an existing low-privileged authenticated session (PR:L), an attack requirement (AT:P) reflecting the enumeration/guessing effort, and only LOW confidentiality impact with no integrity or availability impact. No EPSS score, KEV listing, or SSVC decision data was provided in the input; EPSS and KEV absence should not be treated as signals, but no evidence of active exploitation exists. There is no confirmed exploit code - only a third-party technical writeup (hackmd) and the VulnCheck advisory describe the flaw. The signals are internally consistent (low CVSS, no exploitation evidence, authenticated-only, probabilistic enumeration), so this is a real-but-low-priority information-disclosure issue rather than a high-urgency item. The one caveat worth escalating: in genuinely multi-tenant CloudBeaver deployments where mutually-untrusted users share one instance, the cross-tenant data-leak nature raises practical concern beyond the raw 2.3 score, because a user can read data from connections they are explicitly not authorized to query.

On a shared CloudBeaver instance, a low-privileged authenticated user who cannot query a sensitive connection guesses the target table and column names and brute-forces second-resolution export timestamps to reconstruct the path of another user's LOB export file, then downloads it via WebSQLResultServlet and exfiltrates data they were never authorized to see. A detailed technical writeup exists, but no confirmed weaponized exploit code was identified in the provided sources.