CVE-2023-51982 is a critical authentication bypass in the Admin UI of CrateDB 5.5.1, scored 9.8. A spoofed header can reach the default user. CrateDB fixed it in 5.2.11, 5.3.8, 5.4.7 and 5.5.2, so upgrade, and tighten host based authentication rules.
What's affected
CVE-2023-51982 affects the Admin UI of CrateDB. NVD names version 5.5.1 and published it on 2024-01-30 with a score of 9.8 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
This is a source conflict on versions. The record lists only 5.5.1. The maintainers wrote in the GitHub issue that they were releasing the fix for all supported releases from 5.2 to 5.5, and then reported the releases 5.2.11, 5.3.8, 5.4.7 and 5.5.2 containing the fix. So the exposure is wider than the one version in NVD, and the fixed versions are those four. The fix is pull request 15234 in the crate/crate repository.
The issue also describes the conditions. It involves a host based authentication setup in which the local address uses the trust method for the default user and other addresses use password authentication. Under that setup, setting an X-Real-IP request header to a particular value let the requester reach the Admin UI as the default user. Deployments without that configuration may not be exposed, but I did not verify that, so upgrade anyway.
Weakness class: CWE-287.
How to check if you're exposed
Check the version. With access to a node, this SQL query returns it:
SELECT version['number'] FROM sys.nodes;
If you run CrateDB in Docker, check the image tag in use, for example with docker image ls crate, and compare it to the fixed releases above. A tag such as latest can hide the real version, so confirm it with the query.
Then read your host based authentication settings. Look in crate.yml or your container arguments for lines that begin with auth.host_based. If a rule trusts the local address for the default user, and your instance sits behind a reverse proxy or a load balancer that sets forwarding headers, you match the conditions in the report.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages you ship. It does not inspect appliance firmware or a vendor's closed product, so for this CVE the useful work is asset inventory and vendor follow-up.
What to do now
- Upgrade CrateDB to 5.2.11, 5.3.8, 5.4.7 or 5.5.2 or later, matching your release line.
- Until you can upgrade, apply the maintainers' interim advice and limit the trust rule for the default user to the PostgreSQL protocol. The config lines they posted are:
-
auth.host_based.config.0.user: crate auth.host_based.config.0.address: local auth.host_based.config.0.method: trust auth.host_based.config.0.protocol: pg
4. Do not expose port 4200, which serves the Admin UI, to the internet. Restrict it to trusted addresses at the network layer. The maintainers also recommended an IP allow list for CrateDB Cloud clusters, and said the Cloud team had already mitigated existing clusters.
5. Review the database for users and privileges you do not recognise, because the default user is a superuser. Rotate any credentials you cannot account for.
## Why it matters
The weakness is [CWE-287](https://gold.safeguard.sh/cwe/CWE-287), improper authentication. The reporter's description is that the Admin UI decided how to treat a request partly from a client supplied header. A header like X-Real-IP is only trustworthy when your own proxy sets it, and it is attacker controlled when the service is reachable directly. Trust decisions that rely on it can be forged.
The default user in CrateDB is a superuser, so an authentication bypass to that identity is close to full control of the database. The maintainers responded within the same day the report was filed, and the fixed releases followed. The record's KEV flag is false and I found no report of exploitation in the wild.
## Try it yourself
<iframe src="/demos/container-image-scan/embed" title="Interactive demo: Container image scan" width="100%" height="560" loading="lazy" allowFullScreen></iframe>
Click through it at your own pace, or [open it full screen](/demos/container-image-scan).
## Quick check
<details>
<summary>Which CrateDB versions are fixed?</summary>
The maintainers named 5.2.11, 5.3.8, 5.4.7 and 5.5.2. NVD lists only 5.5.1 as affected. Use the maintainers' list.
</details>
<details>
<summary>Am I exposed if I only use password authentication?</summary>
The report describes a setup that trusts the local address for the default user. If you have no such rule, you may not match, but I did not verify that, so upgrade regardless.
</details>
## Sources
[GitHub issue 15231 in crate/crate](https://github.com/crate/crate/issues/15231) (fetched, includes maintainer replies)
[Fix pull request 15234](https://github.com/crate/crate/pull/15234) (named in the maintainer reply, not fetched)
[NVD record for CVE-2023-51982](https://nvd.nist.gov/vuln/detail/CVE-2023-51982) (the record this guide is built from)
Last reviewed: 19 October 2026.
