Live › vulnerability › CVE-2026-112262
Go to dashboardRisingWave before 3.1.0 lets a low-privileged SQL user create posix_fs sources and fs sinks that point at any directory on the server. An attacker with schema CREATE privilege can read credentials and keys, or write files as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running RisingWave before 3.1.0 where some SQL users hold schema CREATE privilege, since that is what lets them create posix_fs sources and fs sinks. Clusters where only trusted administrators can create objects are at much lower risk. The sources do not say whether managed or default configurations differ.
No product ranges from the sources yet.
risingwave --version or the version shown in the cluster; anything below 3.1.0 is affected.\dn+ or by querying role grants.3.1.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.
This page as .md · .json · in your agent: get_signal("CVE-2026-112262")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.