CVE-2026-108742 in CloudBeaver
Summary
by MITRE • 10/11/2026
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
CloudBeaver versions up through 25.3.5 exhibit a critical missing authorization flaw within its GraphQL API, specifically affecting the initConnection mutation. This vulnerability stems from an insufficient access control mechanism that fails to properly validate user permissions before processing credential persistence requests. In a typical secure implementation, actions involving sensitive data such as database credentials should be restricted based on the principle of least privilege, ensuring that only users with explicit edit or administrative rights can modify connection configurations. However, in this instance, the system allows view-only shared-project members to execute mutations intended for configuration management without triggering appropriate authorization checks.
The technical core of the vulnerability lies in the handling of the saveCredentials and sharedCredentials flags within the initConnection mutation. When a user initiates a database connection, they can specify whether credentials should be saved locally or shared across the project. The flaw permits users who possess only read-only access to set these flags along with arbitrary authentication properties. By doing so, an attacker can inject their own valid database credentials into the shared configuration. This action effectively overwrites or appends the legitimate connection details, allowing subsequent connections initiated by other team members to authenticate using the injected credentials rather than the original intended ones.
The operational impact of this vulnerability is severe and multifaceted. First, it enables credential theft in a stealthy manner, as the attacker does not need to exfiltrate data directly but instead manipulates the authentication flow. Second, it facilitates unauthorized access under the guise of legitimate users. When other team members attempt to connect to the shared database using their assigned permissions, they are actually authenticating with the attacker's credentials. This means that any actions performed by these innocent users during this compromised session can be attributed to the attacker’s identity within the target database system. Consequently, attackers gain persistent access and can perform malicious operations such as data exfiltration, modification, or destruction under a trusted user context, making detection significantly more difficult due to the legitimacy of the source IP and user account involved in the connection attempts.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, where an actor is granted privileges that they should not have based on their role or status. Furthermore, from a tactical perspective related to the MITRE ATT&CK framework, this behavior maps closely to T1078 Valid Accounts and potentially T1534 Internal Spearphishing if used in conjunction with social engineering to trick users into initiating connections. The ability to manipulate shared configurations without edit permissions represents a significant breach of trust within collaborative development environments where CloudBeaver is commonly deployed for database management tasks.
Mitigation strategies must focus on enforcing strict role-based access control (RBAC) checks at the GraphQL mutation level. Developers should ensure that any operation modifying connection settings, particularly those involving credential storage or sharing, requires explicit datasource-edit permissions regardless of whether the user has view-only access to other parts of the project. Additionally implementing input validation and sanitization for all authentication properties passed through mutations can help prevent injection attacks. For immediate remediation, organizations running affected versions should upgrade to a patched release where these authorization checks have been corrected. Until an update is available, restricting GraphQL endpoint access to trusted networks and auditing shared connection configurations regularly can reduce the risk of exploitation by detecting unauthorized changes to credential settings.