PT-2026-53169 · Myscale · Myscaledb

Dem000000 · Published 2026-06-28 · Updated 2026-06-29 · CVE-2026-13513

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MyScale MyScaleDB versions prior to 1.8.1

Description Insufficient verification of data authenticity occurs within the SegmentId::getCacheKey() function located in the src/VectorIndex/Common/SegmentId.h library. This flaw allows for remote attacks, although they are characterized by high complexity and difficult exploitability.

Recommendations As a temporary workaround, restrict access to the SegmentId::getCacheKey() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-13513

Affected Products

Myscaledb

References · 9

• 🔥 https://github.com/myscale/MyScaleDB/issues/54 · Exploit
• https://github.com/myscale/MyScaleDB/pull/55 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-13513 · Security Note
• https://vuldb.com/cve/CVE-2026-13513 · Note
• https://vuldb.com/submit/838878 · Note
• https://github.com/myscale/MyScaleDB · Note
• https://twitter.com/VulmonFeeds/status/2071397728966328617 · Twitter Post
• https://vuldb.com/vuln/374521 · Note
• https://vuldb.com/vuln/374521/cti · Note