Skip to content
OpenAdvisories

Vendor

crate

3 known vulnerabilities.

Products

crate 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-49989

    CrateDB's Blob HTTP handler bypasses authorization

    CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways…

    crate crate io.crate:crate Maven