Summary
generated automatically from NVD dataRisingWave before 3.1.0 has a missing authorization flaw (CWE-862) that lets low-privileged SQL users access arbitrary files on the server. An attacker with schema CREATE privilege can create posix_fs sources and fs sinks, then point posix_fs.root or fs.path at any directory. This allows reading credentials and keys, or writing files as root. The CVSS v3.1 score is 7.1 (HIGH), with network attack vector and low privileges required.
NVD description
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.
CVSS v3.1 Score
Information
- Published
- 19 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Received
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (7)
Similar CVEs
Other vulnerabilities of type CWE-862
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.