CVE-2026-13513 Overview
CVE-2026-13513 affects MyScale MyScaleDB versions up to 1.8.0. The flaw resides in the SegmentId::getCacheKey function within src/VectorIndex/Common/SegmentId.h. The vulnerability stems from insufficient verification of data authenticity [CWE-345], allowing a remote authenticated attacker to manipulate cache key generation. Public exploit code exists, though the attack requires high complexity and the vendor pull request for the fix remains pending acceptance.
Critical Impact
Remote attackers with low privileges can exploit weak data authenticity checks in the vector index cache key logic, potentially leading to limited confidentiality, integrity, and availability impact.
Affected Products
- MyScale MyScaleDB versions up to and including 1.8.0
- Vector index component: src/VectorIndex/Common/SegmentId.h
- Function: SegmentId::getCacheKey
Discovery Timeline
- 2026-06-29 - CVE-2026-13513 published to the National Vulnerability Database (NVD)
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-13513
Vulnerability Analysis
MyScaleDB is a SQL vector database built on ClickHouse for AI and analytical workloads. The vulnerable code path is SegmentId::getCacheKey in the vector index subsystem. This function produces a cache identifier used by the vector index layer to retrieve or store segment data.
Because the function does not sufficiently verify the authenticity of the underlying data used to derive the cache key, an attacker able to influence the inputs can cause the system to trust data that has not been properly validated. The weakness is classified under [CWE-345] (Insufficient Verification of Data Authenticity).
Exploitation is possible over the network but requires high attack complexity, and the attacker must already hold low-level privileges on the database. Public exploit material has been referenced by VulDB.
Root Cause
The root cause is inadequate integrity validation of the data feeding SegmentId::getCacheKey. The function derives a cache key without verifying that the source segment metadata originates from a trusted state. An attacker who influences segment inputs can produce a key that collides with, or substitutes for, a legitimate cached entry.
Attack Vector
The attack is remote and requires authenticated access to the database with low privileges. The attacker submits crafted vector index operations that reach the SegmentId::getCacheKey path. Because of the high complexity requirement, successful exploitation depends on specific runtime conditions in the vector index cache. Refer to the MyScaleDB Issue #54 for the technical writeup.
No verified proof-of-concept code is republished here. See the VulDB entry for CVE-2026-13513 for exploit details.
Detection Methods for CVE-2026-13513
Indicators of Compromise
- Anomalous vector index queries targeting segment cache operations from low-privilege database accounts
- Unexpected cache hits or key collisions in the MyScaleDB vector index layer
- Query patterns that repeatedly invoke SegmentId::getCacheKey with atypical segment identifiers
Detection Strategies
- Audit MyScaleDB query logs for repeated vector index segment operations from the same low-privilege principal
- Compare deployed MyScaleDB build to version 1.8.0 or earlier and flag as vulnerable
- Monitor src/VectorIndex/Common/SegmentId.h runtime behavior for cache key anomalies where telemetry is available
Monitoring Recommendations
- Enable ClickHouse query and access logging on MyScaleDB nodes and forward to a centralized SIEM
- Track authentication events and privilege usage for all database accounts interacting with vector indexes
- Alert on unusual cache invalidation or reload activity within the vector index subsystem
How to Mitigate CVE-2026-13513
Immediate Actions Required
- Inventory all MyScaleDB deployments and identify instances running version 1.8.0 or earlier
- Restrict network access to MyScaleDB to trusted application tiers only
- Apply least-privilege principles to all database accounts and remove unused low-privilege users
- Track the status of the upstream fix in MyScaleDB Pull Request #55
Patch Information
As of the CVE publication date, the pull request to fix CVE-2026-13513 awaits acceptance by the maintainers. No vendor-released patched version is available. Administrators should monitor the MyScaleDB repository for a tagged release incorporating the fix.
Workarounds
- Limit MyScaleDB exposure by placing it behind a network segmentation boundary and application-level gateway
- Restrict who can create or modify vector index segments to trusted service accounts only
- Increase logging verbosity on vector index operations to aid incident response until a patch is available
# Example: restrict MyScaleDB listener to internal interface only
# Edit /etc/clickhouse-server/config.xml
<listen_host>10.0.0.5</listen_host>
# Example: remove unnecessary low-privilege accounts
clickhouse-client --query "DROP USER IF EXISTS legacy_reader"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
