EUVD-2026-40009
GHSA-m84g-jvj9-9qg6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated access plus knowledge of a victim's UUID session ID (AC:H); crosses tenant security boundary (S:C); no availability impact confirmed.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Tenant isolation bypass in Databend up to 1.2.881 allows an authenticated remote attacker to access or corrupt session state belonging to users in other tenants by exploiting a missing tenant dimension in the ClientSessionManager session key derivation. The state_key function generated keys using only username and client_session_id, enabling key collisions across tenants sharing a server process - a flaw confirmed by the PR #19931 diff which adds tenant scoping to all key construction paths. Publicly available exploit code exists; no patched release has been confirmed at time of analysis.
Technical ContextAI
Databend is a cloud-native OLAP data warehouse written in Rust that supports multi-tenant deployments where multiple tenants share a single server process. The vulnerable component, ClientSessionManager in src/query/service/src/servers/http/v1/session/client_session_manager.rs, maintains per-session in-memory state (temporary tables, session variables) using string keys generated by the state_key function. Before the fix, state_key produced keys of the form user_name/client_session_id - omitting the tenant entirely. In a shared-process multi-tenant environment, two tenants with identically named users would resolve to the same key namespace, allowing cross-tenant session state access. CWE-285 (Improper Authorization) is the correct root cause classification: the authorization model fails to include the tenant as a security principal dimension, making all session state globally accessible to any authenticated user who presents a matching username and session ID.
RemediationAI
No vendor-released patched version is confirmed at time of analysis - the upstream fix is pending acceptance as PR #19931 (https://github.com/databendlabs/databend/pull/19931). Monitor this PR and the tracking issue (https://github.com/databendlabs/databend/issues/19930) for merge and apply the resulting release immediately. As a compensating control for multi-tenant deployments, operators can enforce strict network-layer segmentation so that each tenant's HTTP API traffic is routed to a dedicated Databend process or instance, eliminating the shared-state boundary that makes cross-tenant key collision meaningful. This converts a shared-process deployment to isolated-process and eliminates the attack surface at the cost of higher infrastructure overhead. Alternatively, organizations with in-house Rust build capability can apply the PR diff manually and deploy a custom build, though this introduces maintenance burden on future upstream merges. Do not rely on username-uniqueness enforcement alone as a control, as the fix explicitly demonstrates that the tenant identifier must be part of the key derivation.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today