EUVD-2026-40010
GHSA-q6r3-vph9-qrqg
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated network access and a vector-indexed table (AC:H/PR:L); impact is limited to stale search result integrity and limited data disclosure with no availability consequence.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects the function SegmentId::getCacheKey in the library src/VectorIndex/Common/SegmentId.h. The manipulation results in insufficient verification of data authenticity. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
AnalysisAI
Insufficient data authenticity verification in MyScaleDB's vector index cache key function allows authenticated remote users to obtain stale or inconsistent vector search results following mutation operations on indexed columns. Versions through 1.8.0 are affected. A proof-of-concept exploit is publicly available (CVSS 4.0 E:P), though the very low base score of 1.3, high attack complexity, and required authenticated access substantially constrain real-world exploitation impact. No confirmed active exploitation exists - this is not on the CISA KEV list.
Technical ContextAI
MyScaleDB is a ClickHouse-derived vector database that extends the MergeTree storage engine with vector similarity search capabilities and dedicated vector index management. The vulnerable code is in src/VectorIndex/Common/SegmentId.h within the SegmentId::getCacheKey function (CWE-345: Insufficient Verification of Data Authenticity). The PR diff reveals the root cause: the MergeTree mutation pipeline (MutateTask.cpp) failed to detect when an ALTER TABLE UPDATE command targeted a vector-indexed column, meaning the associated vector index files were neither rebuilt nor invalidated during the mutation. After the mutation committed, the getCacheKey function returned cache identifiers tied to the pre-mutation segment state, allowing subsequent similarity queries to be served from stale index data. The proposed fix both rejects UPDATE mutations on vector-indexed columns with QUERY_NOT_ALLOWED and adds skipVectorIndexFilesForRebuild logic to properly mark index files for rebuild when such mutations do occur.
RemediationAI
No vendor-released patched version is available at time of analysis. A fix is proposed in GitHub Pull Request #55 (https://github.com/myscale/MyScaleDB/pull/55), which was pending maintainer acceptance when this CVE was filed. The PR implements two changes: it causes ALTER TABLE UPDATE operations targeting vector-indexed columns to fail with a QUERY_NOT_ALLOWED error (preventing the inconsistency from arising), and adds skipVectorIndexFilesForRebuild to properly handle index file lifecycle during mutations. Until the PR is merged and a tagged release ships, administrators should restrict database user permissions to prevent execution of ALTER TABLE UPDATE (mutation commands) on tables that carry vector indices. This compensating control trades off the ability to perform in-place column mutations, which may require application-level workarounds such as table recreation for schema changes. Monitor GitHub Issue #54 and PR #55 for patch availability before upgrading.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today