CVE-2026-121881: Posit Workbench code-server session-state RPC (get_last_seen) SQL injection

Published Nov 6, 2026

Updated

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter.

NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Posit Workbench to a version that resolves this vulnerability.
Fixed in 2026.08.0

Event History

Nov 6, 2026

CVE Published

via MITRE·03:10 PM

Data Sourced

via MITRE·03:10 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

Any user with a valid authenticated Posit Workbench session can exploit it. Administrative privileges are not required.

What can an attacker access if exploitation succeeds?

The issue allows disclosure of arbitrary data from the Workbench database through SQL injection in the sessionIds parameter. The reported impact is limited to reading database contents.

Which deployments need remediation?

Posit Workbench versions before 2026.08.0 are affected. Updating to 2026.08.0 or later addresses the affected version range.

CVE-2026-121881: Posit Workbench code-server session-state RPC (get_last_seen) SQL injection

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What can an attacker access if exploitation succeeds?

Which deployments need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What can an attacker access if exploitation succeeds?

Which deployments need remediation?