Read the docs
TI-2024-16186 Aliases CVE-2024-24565GHSA-475g-vj6c-xf96

CrateDB database has an arbitrary file read vulnerability

Priority MEDIUM 62CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8, 5.5.4, and 5.6.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03084 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed crate (crate): 5.3.9, 5.4.8, 5.5.4 +1io.crate:crate (Maven): 5.3.9, 5.4.8, 5.5.4 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cratecratebefore 5.3.9; 5.4.0 to before 5.4.8; 5.5.0 to before 5.5.4; 5.6.0 to before 5.6.15.3.9, 5.4.8, 5.5.4, 5.6.1Patch availableCNA
—io.crate:crate (Maven)before 5.3.95.3.9Patch availableGHSA-475g-vj6c-xf96
—io.crate:crate (Maven)5.4.0 to before 5.4.85.4.8Patch availableGHSA-475g-vj6c-xf96
—io.crate:crate (Maven)5.5.0 to before 5.5.45.5.4Patch availableGHSA-475g-vj6c-xf96
—io.crate:crate (Maven)5.6.0 to before 5.6.15.6.1Patch availableGHSA-475g-vj6c-xf96
  • crate Vendorcrate Affected before 5.3.9; 5.4.0 to before 5.4.8; 5.5.0 to before 5.5.4; 5.6.0 to before 5.6.1 Fixed in 5.3.9, 5.4.8, 5.5.4, 5.6.1 Patch available CNA
  • io.crate:crate (Maven) Vendor— Affected before 5.3.9 Fixed in 5.3.9 Patch available GHSA-475g-vj6c-xf96
  • io.crate:crate (Maven) Vendor— Affected 5.4.0 to before 5.4.8 Fixed in 5.4.8 Patch available GHSA-475g-vj6c-xf96
  • io.crate:crate (Maven) Vendor— Affected 5.5.0 to before 5.5.4 Fixed in 5.5.4 Patch available GHSA-475g-vj6c-xf96
  • io.crate:crate (Maven) Vendor— Affected 5.6.0 to before 5.6.1 Fixed in 5.6.1 Patch available GHSA-475g-vj6c-xf96

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cratedb:cratedb:*:*:*:*:*:*:*:*before 5.3.9; 5.4.0 to before 5.4.8; 5.5.0 to before 5.5.4; 5.6.0 to before 5.6.1VulnerableCratedb
  • cpe:2.3:a:cratedb:cratedb:*:*:*:*:*:*:*:* Versions before 5.3.9; 5.4.0 to before 5.4.8; 5.5.0 to before 5.5.4; 5.6.0 to before 5.6.1 Vulnerable ·Cratedb

Remediation

  • Fix · CNA crate (crate) Fixed in 5.3.9, 5.4.8, 5.5.4, 5.6.1
  • Fix · GHSA-475g-vj6c-xf96 io.crate:crate (Maven) Fixed in 5.3.9 Advisory →
  • Fix · GHSA-475g-vj6c-xf96 io.crate:crate (Maven) Fixed in 5.4.8 Advisory →
  • Fix · GHSA-475g-vj6c-xf96 io.crate:crate (Maven) Fixed in 5.5.4 Advisory →
  • Fix · GHSA-475g-vj6c-xf96 io.crate:crate (Maven) Fixed in 5.6.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24565
  2. 2026-10-03 Alias added: GHSA-475g-vj6c-xf96

References

Exploit 1

Patch 1

Advisory 1

Other 5

  • TI-2026-36821 CrateDB's Blob HTTP handler bypasses authorization CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences