CVE-2026-55449 · Package
NO FIX YET · SEE WHAT TO DO
CloudBeaver, a cloud database manager, does not validate project identifiers before resolving shared-project paths. An authenticated user with resource-management privileges can use a crafted identifier to escape the shared-projects directory and enumerate directory names elsewhere on the server.
first public Jul 2, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a self-hosted CloudBeaver instance with resource-management features and users who hold resource-management privileges. The flaw needs a logged-in account, so instances without such users are at lower risk. Managed hosting by others is outside this scope unless the operator has not patched.
Not affected if no-resource-management-users, unauthenticated-only-access
Who cares cloudbeaver, database-tools, self-hosted
26.1.2.26.1.2 or later.CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.