PSA-2026-0003: SQL injection in the Posit Workbench code-server session-state RPC

Security

Posit Security Advisory (PSA) for a SQL injection vulnerability in the get_last_seen code-server session-state remote procedure call (RPC) in Posit Workbench

Published

November 6, 2026

Source advisory: RStudio and Workbench 2026.08.0 release notes

Common Vulnerabilities and Exposures (CVE) ID: CVE-2026-121881

Common Weakness Enumeration (CWE): CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’))

Severity: Medium, with a Common Vulnerability Scoring System (CVSS) v4.0 score of 5.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:C/RE:M/U:Amber)

Affected versions: Workbench, all releases through 2026.07.1

Fixed version: 2026.08.0

Description

A SQL injection vulnerability exists in the get_last_seen code-server session-state remote procedure call (RPC) in Workbench through 2026.07.1. Authenticated users can use the sessionIds parameter to read arbitrary data from the Workbench database. The endpoint is reachable over HTTP with only a valid session cookie. Workbench concatenates the caller-supplied session identifiers into the query instead of binding them as parameters.

Note

Exploitation requires an authenticated account on the Workbench server, but no administrative privileges. The vulnerability only allows disclosure of database contents. If the database holds unencrypted credentials, an attacker who reads them can act as other users against external services. In that case, the impact is higher than the base score reflects.

Resolution

Upgrade Workbench to 2026.08.0 or later by installing the new version over the existing installation. For full steps, see Upgrade Workbench. For example, on Ubuntu or Debian:

Terminal

curl -O https://download2.rstudio.org/server/jammy/amd64/rstudio-workbench-2026.08.0-amd64.deb
sudo apt-get install ./rstudio-workbench-2026.08.0-amd64.deb

From 2026.08.0, Workbench binds the session identifiers as query parameters instead of concatenating them into the SQL statement.

No configuration workaround fully mitigates this issue on affected versions. If you cannot upgrade immediately, reduce exposure by limiting Workbench accounts to trusted users until you can upgrade.