CVE-2026-112262

7.1High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Low-privileged SQL users with schema CREATE privileges can read and write arbitrary server files, potentially exposing credentials and keys or writing files as root. This requires network access and an existing authenticated database user account.

Root cause

Missing authorization checks on posix_fs sources and fs sinks let users point posix_fs.root or fs.path to arbitrary host directories.

Affected systems

RisingWave versions before 3.1.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Fix & remediation

Upgrade to RisingWave 3.1.0 or later. As an interim workaround, revoke schema CREATE privileges from untrusted SQL users to prevent source and sink creation.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112262