PT-2026-117406 · Risingwavelabs · Risingwave
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix fs.root or fs.path to any directory to read credentials and keys or write files as root.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Risingwave