CVE-2026-13512 Overview
CVE-2026-13512 is an authorization bypass vulnerability [CWE-285] affecting Databend versions up to 1.2.881. The flaw resides in the ClientSessionManager::state_key function within src/query/service/src/servers/http/v1/session/client_session_manager.rs, part of the Tenant Handler component. Attackers with low-privileged access can manipulate session state handling over HTTP to bypass authorization controls. The vulnerability is remotely exploitable and a public exploit has been disclosed. At the time of publication, the pull request addressing the issue was awaiting acceptance upstream.
Critical Impact
Remote authenticated attackers can bypass tenant authorization boundaries in Databend, potentially accessing data or session contexts outside their assigned scope.
Affected Products
- Databend versions up to and including 1.2.881
- Databend HTTP server component (ClientSessionManager)
- Databend Tenant Handler subsystem
Discovery Timeline
- 2026-06-28 - CVE-2026-13512 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-13512
Vulnerability Analysis
The vulnerability originates in the ClientSessionManager::state_key function in client_session_manager.rs. This function constructs the key used to track and validate session state for a given tenant. Improper handling of the state key allows manipulation that leads to authorization bypass, meaning an attacker can influence which session or tenant context is served for a request. Because the Tenant Handler relies on this key to enforce isolation between tenants, weak key derivation directly translates into broken access control. The attack requires only low privileges (PR:L) and no user interaction, making it practical against any exposed HTTP endpoint accepting authenticated traffic. The scope of the impact is limited to confidentiality, integrity, and availability of data within the vulnerable component.
Root Cause
The root cause is improper authorization [CWE-285] in the session state key generation logic. The state_key function fails to sufficiently bind session state to the requesting principal or tenant, allowing an attacker to craft requests that resolve to a session context belonging to a different tenant. This is a design-level access control flaw rather than a memory safety issue.
Attack Vector
An attacker authenticates to the Databend HTTP endpoint with low-privileged credentials and issues crafted requests that manipulate the parameters influencing state_key construction. Because a public exploit is available and no user interaction is required, automated abuse against reachable Databend deployments is feasible. Detailed technical information is documented in GitHub Issue #19930 and the proposed fix in GitHub Pull Request #19931.
Detection Methods for CVE-2026-13512
Indicators of Compromise
- HTTP requests to Databend session endpoints containing unusual or malformed tenant identifiers or session state parameters.
- Authenticated sessions returning data or metadata belonging to tenants other than the authenticated principal.
- Repeated session reuse patterns from a single client across multiple tenant contexts.
Detection Strategies
- Enable verbose access logging in the Databend HTTP layer and inspect ClientSessionManager activity for cross-tenant state key collisions.
- Correlate authenticated user identifiers against tenant identifiers served in each response to identify mismatches.
- Deploy application-layer rules that alert on session identifiers reused across distinct authenticated principals.
Monitoring Recommendations
- Aggregate Databend HTTP server logs into a centralized analytics platform and baseline normal per-tenant request patterns.
- Alert on privilege escalation indicators such as read operations on tenant catalogs a user is not entitled to query.
- Monitor for spikes in 200-OK responses following anomalous session parameter manipulation attempts.
How to Mitigate CVE-2026-13512
Immediate Actions Required
- Restrict network exposure of the Databend HTTP interface to trusted management networks until a fixed release is applied.
- Rotate all tenant credentials and invalidate active sessions to remove any attacker-established state.
- Track adoption of GitHub Pull Request #19931 and upgrade to a Databend release that incorporates the fix once published.
Patch Information
At the time of publication, the upstream fix is proposed in GitHub Pull Request #19931 but has not yet been accepted into a released version. Administrators should monitor the Databend issue tracker and apply the patch as soon as it is merged and shipped. Additional references are available at VulDB CVE-2026-13512.
Workarounds
- Place Databend behind an authenticating reverse proxy that enforces tenant identity binding at the edge before requests reach ClientSessionManager.
- Disable or tightly restrict shared session endpoints if operational requirements permit, forcing per-request re-authentication.
- Apply web application firewall rules to reject requests containing unexpected session state parameters or malformed tenant identifiers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
