databend vulnerabilities

Products

• databend 1

Latest databend CVEs

Newest publication first

1. CVE-2026-13512 Databend Tenant client_session_manager.rs state_key authorization

   Published 2026-06-28

   Medium·CVSS 5.3

   A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler. The manipulation leads to authorization...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.