VULNERABILITY INTELLIGENCE
CVE-2026-13512
CVSS score6.3 MEDIUM
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-06-28
Last modified2026-06-30
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Weakness classification
- cna@vuldb.com: CWE-285