In MyScaleDB versions up to 1.8.0, the function SegmentId::getCacheKey in src/VectorIndex/Common/SegmentId.h does not properly verify the authenticity of data used to compute cache keys. This flaw allows an attacker who can supply crafted input to bypass authenticity checks and influence index cache key generation. The weakness is classified as CWE‑345. While the CVSS score of 2.3 reflects a limited impact, the vulnerability can be exploited remotely, albeit with high technical complexity.

The vulnerability affects MyScaleDB distributed as MyScale:MyScaleDB for all publicly available builds up to and including 1.8.0. Users operating any version of this product prior to the pending fix are susceptible. No other vendors or product lines are identified.

The attack vector is remote, requiring the attacker to supply malicious input to the getCacheKey routine. The lack of an available EPSS score and absence from CISA KEV suggest low observable exploitation, but the vulnerability remains exploitable. Given the low CVSS score, the overall risk to confidentiality, integrity, and availability is limited; however, monitoring for abnormal cache key activity is prudent until the pull request is merged.