CVE-2026-59094: Unauthenticated Denial-of-Service in Pathway Document Store Glob Pattern Matching

Technical summary

CVE-2026-59094 exploits a hand-written recursive glob pattern matcher in Pathway's document store that lacks memoization. The vulnerability exists in the /v1/retrieve, /v1/inputs, and /v2/answer endpoints, which accept user-supplied filepath_globpattern values from unauthenticated HTTP requests without validation on pattern length or token count. The matcher branches exponentially on each ** (double-asterisk) wildcard token, producing O(2^n) complexity where n is the number of ** tokens in the pattern. A single malicious request can trigger CPU exhaustion lasting 10–60 seconds; multiple concurrent requests reliably saturate resources and trigger service timeouts.

Business impact

This vulnerability enables trivial remote denial-of-service attacks against Pathway deployments. No authentication is required, and attack tooling is elementary. Services relying on Pathway for document retrieval or question-answering workflows will experience service interruptions, impacting end-user availability and potentially disrupting downstream applications or SLAs. The low barrier to exploitation means threat actors require minimal sophistication; denial-of-service campaigns could be launched by script-kiddie threat actors or integrated into automated vulnerability scanning/exploitation suites.

Affected systems

Pathway versions up to and including 0.31.1 are affected. The vulnerability is present in any deployment that exposes the /v1/retrieve, /v1/inputs, or /v2/answer endpoints to network traffic. Confirm your deployed version against vendor advisory guidance; the fix is available in commit d09722e and subsequent releases.

Exploitability

Exploitability is extremely high. No credentials, authentication tokens, or prior system knowledge are required. An attacker needs only to craft a glob pattern with multiple ** tokens and send it via HTTP POST or GET to a vulnerable endpoint. The attack is deterministic and repeatable, with no race conditions or timing windows. Automated attack tools would be trivial to develop. The CVSS 3.1 score of 7.5 (HIGH) reflects the availability impact; the attack vector is Network (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and affects only availability (A:H), not confidentiality or integrity.

Remediation

Upgrade to Pathway versions that include commit d09722e or later. Verify the exact patch version in vendor security advisories before deploying. As an interim mitigation, network-level rate limiting on the three vulnerable endpoints can slow exploitation but does not eliminate the risk; apply strict limits on request frequency and pattern complexity if immediate patching is not feasible. Do not rely solely on rate limiting as a long-term solution.

Patch guidance

Apply the vendor patch by upgrading Pathway to the fixed version indicated in the official security advisory. Before upgrading, test the patched version in a staging environment to confirm compatibility with your application and any custom glob patterns in use. The fix replaces the exponential matcher with a memoized or polynomial-time algorithm; upgrade as soon as possible, prioritizing internet-facing or load-bearing deployments.

Detection guidance

Monitor application logs for anomalously long request processing times on /v1/retrieve, /v1/inputs, and /v2/answer endpoints. Watch for POST or GET requests containing filepath_globpattern parameters with many ** tokens or unusually long pattern strings. Implement alerts for response times exceeding your baseline by 10× or more on these endpoints. Network-level monitoring can flag repeated requests to these endpoints from the same source within short time windows. Correlate high CPU usage with inbound requests to these endpoints to identify active exploitation attempts.

Why prioritize this

This vulnerability warrants immediate attention due to its trivial exploitability, lack of authentication requirement, and direct impact on service availability. It is not listed on the KEV catalog, indicating it may have lower visibility in threat landscapes, but the low attack complexity makes it an attractive target for opportunistic or targeted denial-of-service campaigns. Organizations should prioritize patching within days rather than weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) correctly reflects a severe but not critical vulnerability. The attack vector is Network, accessibility is unauthenticated, and there are no special conditions (AC:L). However, the impact is limited to availability (denial of service); confidentiality and integrity remain unaffected. The score does not account for business context (e.g., how critical Pathway is to your operations), so assess internal risk independently. If Pathway is essential to customer-facing services, treat this as business-critical and accelerate patching.

Frequently asked questions