CVE-2026-49989: 
Java vulnerability analysis and mitigation

CVE-2026-49989 is an incorrect authorization vulnerability in CrateDB's blob HTTP handler (io.crate.protocols.http.HttpBlobHandler) that allows any authenticated user to read, delete, or plant blobs in any blob table, regardless of configured GRANT permissions. The vulnerability was first published on May 27, 2026, and added to the GitHub Advisory Database on July 1, 2026. It affects CrateDB versions prior to 6.2.8 and versions 6.3.0 through 6.3.2 (exclusive). The CVSS v4.0 base score is 7.1 (High), while the CVSS v3.1 score is listed as 0.0 due to the scoring methodology applied by the reporter; the practical severity is considered High by Feedly's estimate (GitHub Advisory, CrateDB Advisory).

The root cause is CWE-863 (Incorrect Authorization): the HttpBlobHandler.java dispatcher at line 176 routes GET, HEAD, PUT, and DELETE requests directly to blob operations without invoking AccessControl or calling ensureHasPrivilege() (GitHub Advisory). CrateDB enforces privilege grants only on the SQL path (via AccessControlImpl), so while SELECT digest FROM blob.secret_blobs correctly returns MissingPrivilegeException for an unprivileged user, a direct HTTP request to GET /_blobs/secret_blobs/<digest> returns 200 OK with the blob content. The attack requires network access to the CrateDB HTTP port (default 4200) and valid credentials for any account — no elevated privileges are needed. A public end-to-end Docker-based PoC demonstrating the bypass was included in the advisory (CrateDB Advisory).

Successful exploitation allows an authenticated but unprivileged user to read any blob from any blob table (confidentiality breach), delete blobs they have no grants on (data destruction/integrity breach), and unconditionally upload new blobs to any blob table (storage pollution). The read and delete capabilities require knowledge of the target blob's SHA-1 digest, which may be obtained via application metadata, logs, or side-channel probes using HEAD /_blobs/<table>/<digest> as an existence oracle. Deployments that do not use BLOB TABLE are entirely unaffected (GitHub Advisory, CrateDB Advisory).

A public proof-of-concept (Docker-based exploit script) was published alongside the advisory, demonstrating the full attack chain (CrateDB Advisory). The NVD SSVC assessment classifies exploitation evidence as "poc" with technical impact rated "partial" and automatable as "no" (Feedly). The EPSS score is approximately 0.269% (19th percentile), indicating a low but non-negligible probability of exploitation in the wild within 30 days. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify CrateDB instances exposing the HTTP API (default port 4200) using network scanning tools such as Shodan or Nmap. Confirm the version is below 6.2.8 or between 6.3.0 and 6.3.2.
2. Obtain credentials: Acquire any valid CrateDB user account credentials — even a low-privilege account with no grants on blob tables is sufficient.
3. Identify target blob digest: Obtain the SHA-1 digest of a target blob via application metadata, logs, or by probing with HEAD /_blobs/<table>/<digest> requests to confirm blob existence.
4. Read blob (unauthorized): Issue an authenticated HTTP GET request to bypass authorization:

   curl -u unprivileged:unpriv123 http://<cratedb-host>:4200/_blobs/secret_blobs/<sha1-digest>

   The server returns 200 OK with the full blob content despite the user having no SQL grants.
5. Delete blob (unauthorized): Issue an authenticated HTTP DELETE request to destroy data:

   curl -u unprivileged:unpriv123 -XDELETE http://<cratedb-host>:4200/_blobs/secret_blobs/<sha1-digest>

   The server returns 204 No Content, confirming deletion.
6. Plant arbitrary blobs (unauthorized): Issue an authenticated HTTP PUT request to inject data into any blob table:

   curl -u unprivileged:unpriv123 -XPUT http://<cratedb-host>:4200/_blobs/any_table/<sha1-of-content> -d '<malicious-content>'

   No grants are required for this operation (CrateDB Advisory).

• Network: Unexpected HTTP GET, PUT, or DELETE requests to /_blobs/<table>/<digest> endpoints on CrateDB port 4200 from accounts that do not have SQL grants on the corresponding blob table; HEAD requests to blob endpoints used as existence probes from low-privilege accounts.
• Logs: CrateDB HTTP access logs showing 200 OK or 204 No Content responses to blob API requests from users who receive MissingPrivilegeException on equivalent SQL queries; repeated HEAD requests to blob endpoints suggesting digest enumeration attempts.
• Behavioral: Blob tables with unexpected new content (PUT by unprivileged users) or missing blobs (DELETE by unprivileged users) that cannot be explained by authorized SQL operations; discrepancy between SQL-accessible blob counts and actual stored blobs (CrateDB Advisory).

Upgrade CrateDB to version 6.2.8 (for the 6.2.x branch) or 6.3.2 (for the 6.3.x branch), which fix the issue by plumbing AccessControl into HttpBlobHandler and calling ensureHasPrivilege() before dispatching blob operations (GitHub Advisory). As a temporary workaround, restrict network access to the CrateDB HTTP port (4200) using firewall rules to limit which clients can reach the blob API. Deployments that do not use BLOB TABLE are not affected and require no action.