A flaw in Databend’s Tenant Handler allows an attacker to tamper with the state_key parameter in the ClientSessionManager::state_key routine. This manipulation bypasses normal access controls, granting unauthorized privileges and potentially exposing or altering tenant data. The weakness aligns with missing authorization (CWE‑285) and abuse of a user‑controlled key to bypass restrictions (CWE‑639).

Databend versions up to and including 1.2.881 that expose the HTTP interface are affected. The issue resides in the file src/query/service/src/servers/http/v1/session/client_session_manager.rs within the Tenant Handler component. Systems running any of these versions without the fix and with the HTTP endpoint reachable from untrusted networks are at risk.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, but the exploit code is publicly available and an attacker can execute it remotely via HTTP. Without remediation, the risk remains that unauthorized users may gain privileged access to tenant resources.