NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Posit Software, PBC | Posit Workbench | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Posit Workbench 2026.08.0 or later. The patched release binds the caller-supplied session identifiers as query parameters instead of concatenating them into the SQL statement.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 06 Nov 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents. | |
| Title | Posit Workbench code-server session-state RPC (get_last_seen) SQL injection | |
| First Time appeared |
Posit
Posit workbench |
|
| Weaknesses | CWE-89 | |
| CPEs | cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Posit
Posit workbench |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: POSIT
Published:
Updated: 2026-11-06T17:45:42.672Z
Reserved: 2026-11-04T10:49:23.575Z
Link: CVE-2026-121881
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-06T16:17:53.160
Modified: 2026-11-06T18:18:01.020
Link: CVE-2026-121881
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-06T17:15:06Z