Permission Validation Flaw in openGauss-server Database by openGauss
CVE-2026-111439

4.3MEDIUM

Key Information:

Vendor

Opengauss-server

Status
Opengauss-server
Vendor
CVE Published:
19 October 2026

What is CVE-2026-111439?

A security flaw exists in the openGauss-server where the function pg_read_binary_file_blocks() fails to properly check user permissions before allowing access to binary data blocks. While it verifies the start block number and block count, it neglects to enforce SELECT permissions necessary for accessing the underlying data. This oversight enables a user with basic database connection permissions to access binary blocks of data directly from a table, even if they lack the appropriate privileges. This issue is present in versions 3.0.0 through 6.0.0 and has been addressed in version 7.0.0-LTS.

Affected Version(s)

openGauss-server openEuler Centos 3.0.0-3.0.5

openGauss-server openEuler Centos 3.1.0-3.1.1

openGauss-server openEuler Centos 5.0.0-RC1

References

https://gitcode.com/opengauss/openGauss-server/pull/9374

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.