CVE-2026-13513: MyScaleDB Cache Validation Vulnerability

Technical summary

CVE-2026-13513 affects the SegmentId::getCacheKey function in src/VectorIndex/Common/SegmentId.h within MyScaleDB. The flaw stems from insufficient verification of data authenticity in the caching layer for vector index segment identifiers. An attacker with valid credentials can craft malicious requests that exploit the weak cache validation, potentially compromising the integrity and confidentiality of stored vector data. The vulnerability requires network access and valid login credentials, but does not require user interaction on the victim's part.

Business impact

Organizations running MyScaleDB for vector search or similarity operations face risk of data tampering and unauthorized access to sensitive embeddings or indexed content. If MyScaleDB is used in production search pipelines, credential-based attackers could exfiltrate or modify indexed vectors without detection, degrading search quality or leaking proprietary AI model outputs. The medium severity and authentication requirement limit blast radius, but insider threats or compromised service accounts pose a material risk.

Affected systems

MyScaleDB versions 1.8.0 and earlier are affected. Organizations should inventory all MyScaleDB deployments and determine the installed version immediately. The vulnerability requires valid authentication, so it does not affect publicly exposed instances without credential compromise. Development, staging, and production environments all require assessment.

Exploitability

While a proof-of-concept has been released publicly, the attack complexity is high and requires valid user credentials. This is not a trivial zero-click vulnerability; an attacker must obtain or already possess legitimate access credentials. The high barrier to entry reduces immediate widespread exploitation risk, but the availability of public PoC code means that sophisticated or motivated threat actors with internal access or those targeting specific organizations can leverage it effectively.

Remediation

Organizations should update MyScaleDB to a version that includes the fix for the SegmentId::getCacheKey cache validation. Verify the patched version against the official MyScale vendor advisory. Additionally, restrict database access through network segmentation, enforce strong authentication policies, and monitor for unusual data access patterns. Consider rotating credentials for accounts with MyScaleDB access if a compromise is suspected.

Patch guidance

Monitor the MyScale project repository and official release notes for confirmation that the pending pull request fixing this vulnerability has been merged and released. Once a patched version is available, prioritize deployment to production systems handling sensitive vector data. Test patches in staging environments before production rollout to ensure compatibility with dependent applications. If an extended timeline before patching is necessary, compensate with enhanced network controls and access logging.

Detection guidance

Audit MyScaleDB access logs for unusual authentication patterns or repeated failed/successful queries originating from unexpected sources. Monitor for cache-related anomalies in application performance metrics or database query patterns. Implement alerting on modification attempts to segment cache structures. Network-level detection should flag authentication events followed by unusual vector index operations. Query logs that show rapid or sequential access to multiple segment identifiers may indicate exploitation attempts.

Why prioritize this

This vulnerability merits prompt but measured attention. The medium CVSS score reflects the authentication requirement and high attack complexity, which significantly limit opportunistic exploitation. However, the released PoC and the focus on data authenticity in a vector database context—often containing sensitive embeddings—elevate the business risk for organizations in AI/ML, search, or recommendation engine domains. Prioritization should align with MyScaleDB criticality in your architecture and the sensitivity of indexed data.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) appropriately reflects the attack vector (network-based), the requirement for valid credentials (PR:L), high complexity (AC:H), and the limited scope (confidentiality, integrity, and availability each partially affected). The score does not account for the released public PoC, which increases practical exploitability for determined attackers but does not change the baseline difficulty or prerequisites. Organizations storing highly sensitive vectors should consider contextual risk elevation.

Frequently asked questions