SQL Injection Vulnerability in Posit Software's Posit Workbench
CVE-2026-121881

5.7MEDIUM

Key Information:

Vendor

Posit Software, Pbc

Status
Posit Workbench
Vendor
CVE Published:
6 November 2026

What is CVE-2026-121881?

An SQL injection vulnerability exists within the get_last_seen session-state RPC of Posit Workbench prior to version 2026.08.0. This flaw permits authenticated users to access arbitrary data from the Workbench database by exploiting the sessionIds parameter. It's crucial to note that the exploitation does not require administrative privileges, placing sensitive database contents at risk of unauthorized disclosure.

Affected Version(s)

Posit Workbench Linux 0 < 2026.08.0

References

https://docs.posit.co/ide/news/#rstudio-2026.08.0
release-notesvendor-advisory
https://trust.posit.co/updates
vendor-advisory

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.