CVE-2026-121881 · Runtime
NO FIX YET · SEE WHAT TO DO
A SQL injection flaw in the get_last_seen session-state RPC of Posit Workbench lets an authenticated user pass crafted sessionIds values to the database. An attacker can read arbitrary data from the Workbench database, but cannot change it.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Posit Workbench before 2026.08.0 where users hold valid logins. Exposure comes from the session-state RPC reachable by any authenticated user; no admin rights are needed. Servers where only trusted staff have accounts carry less practical risk, but the fix is still the version upgrade.
Not affected if no-user-accounts, posit-workbench-2026.08.0-or-later
Who cares data-science, posit-workbench, rstudio, self-hosted
rstudio-server version on the server) and compare it with 2026.08.0.2026.08.0 or later.SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter.
NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.