Missing Authorization Vulnerability in RisingWave by RisingWave Labs

CVE-2026-112262

What is CVE-2026-112262?

RisingWave prior to version 3.1.0 has a missing authorization vulnerability that enables low-privileged SQL users to manipulate server files. This is achieved through creating posix_fs sources and fs sinks, allowing such users to read from and write to arbitrary directories on the server. Specifically, attackers with schema CREATE privilege can exploit this flaw by adjusting the posix_fs.root or fs.path settings, which could lead to unauthorized access to sensitive credentials and keys, or the ability to write files with elevated privileges. This vulnerability highlights the critical need for stricter access controls in database environments to prevent potential data breaches and system compromises.

References