CVE-2026-13512: Databend Authorization Bypass in Session Manager

Technical summary

The vulnerability resides in the ClientSessionManager::state_key function within Databend's HTTP server component (Tenant Handler). It stems from improper authorization enforcement when handling session state transitions. An authenticated user can craft requests that manipulate the session state key mechanism, allowing them to circumvent intended access controls. The issue affects the authorization framework rather than authentication itself, meaning a valid login is required but the subsequent permission checks can be bypassed. This is categorized as both an authorization weakness (CWE-285) and an insufficient permission assignment issue (CWE-639).

Business impact

Organizations using Databend as a data warehouse or query service face the risk of data exposure and unauthorized modification. An internal user or compromised account can escalate privileges or access data belonging to other tenants or administrative functions without proper authorization. In multi-tenant deployments, this creates cross-tenant isolation failures. The availability of public exploit code increases the likelihood that this vulnerability will be weaponized, particularly in environments where Databend is internet-facing or accessible to untrusted networks.

Affected systems

Databend versions up to and including 1.2.881 running on HTTP are affected. The vulnerability is in the core session management layer of the HTTP server component, so all deployments using that version range face potential exposure. Organizations should identify and inventory all Databend instances in their environment, paying particular attention to those exposed over the network.

Exploitability

The CVSS 3.1 score of 6.3 (Medium) reflects that exploitation requires prior authentication (PR:L) but is otherwise straightforward: no special conditions (AC:L), no user interaction needed (UI:N), and network accessibility (AV:N). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but proof-of-concept code is publicly available, meaning practical exploitation methods are documented and accessible. Threat actors do not require advanced reverse engineering; the attack is repeatable and reliable.

Remediation

Apply an updated version of Databend that includes the authorization bypass fix. The vendor has a pull request addressing this issue that is awaiting acceptance and integration into a release. Monitor Databend's GitHub repository and release notes for the next patched version. Until a patch is released and deployed, consider restricting network access to Databend HTTP endpoints to trusted internal networks only and enforcing strong authentication policies.

Patch guidance

Check Databend's official GitHub releases and security advisories for a patched version beyond 1.2.881. When available, upgrade to the confirmed fixed version. Verify the fix by reviewing the merged pull request and confirming the ClientSessionManager::state_key function has been corrected. Test the patch in a staging environment before rolling out to production, particularly in multi-tenant scenarios where authorization bypass poses the greatest risk.

Detection guidance

Monitor HTTP request logs for unusual patterns in session-state parameters or repeated authorization failures followed by successful operations. Look for requests that attempt to manipulate or reuse session state keys across different users or tenants. Implement detection rules for suspicious session transitions, particularly those that precede high-privilege operations. Security information and event management (SIEM) systems should flag authentication bypasses or unexpected permission escalations. Review Databend audit logs (if available) for session anomalies.

Why prioritize this

This vulnerability should be prioritized because it enables authenticated attackers to bypass authorization controls with public exploit code available. The attack requires only network access and a valid credential—a low bar in many environments. In multi-tenant or cloud deployments, the blast radius is significant. The Medium CVSS score may understate business risk if Databend stores sensitive data or is part of a critical analytics pipeline. Immediate action is warranted in organizations where data confidentiality and cross-tenant isolation are compliance requirements.

Risk score, explained

CVSS 3.1 assigns a score of 6.3 (Medium) because the vulnerability requires an authenticated attacker (reducing impact compared to unauthenticated flaws) but delivers real harm across confidentiality, integrity, and availability (C:L, I:L, A:L). The low attack complexity (AC:L) and network accessibility (AV:N) elevate the score. Public exploit availability and the absence of CISA KEV listing do not change the CVSS score itself, but they materially increase operational risk. Organizations should treat this as high-priority despite the Medium score label.

Frequently asked questions