CVE-2026-112262 in RisingWave
Summary
by MITRE • 10/19/2026
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in RisingWave versions prior to 3.1.0 represents a critical failure in access control mechanisms, specifically classified under CWE-269 Improper Privilege Management. This flaw allows users with low-level privileges, such as the ability to create schemas or execute basic SQL statements, to escalate their rights significantly by interacting directly with the underlying file system of the server hosting the database engine. The core technical issue stems from the implementation of posix_fs sources and fs sinks within the data ingestion pipeline. These components are designed to facilitate the movement of data between external files and the streaming database but lack sufficient validation regarding the user's authorization level or the target directory path. Consequently, an attacker can manipulate configuration parameters such as posix_fs.root or fs.path to point toward sensitive system directories that should be inaccessible to standard users.
From a technical perspective, this vulnerability exploits the trust placed in SQL-based interface configurations without enforcing strict boundary checks on file paths. When a user creates a source or sink using these specific connectors, they can specify arbitrary absolute paths for reading input data or writing output results. Because RisingWave often runs with elevated privileges to manage database operations efficiently, any write operation performed through this vector inherits those high-level permissions. This means that an attacker does not merely gain read access to their own user files but can potentially overwrite system binaries, modify configuration files, or plant malicious scripts in directories typically reserved for the root account or service accounts. The absence of path canonicalization and restriction checks allows directory traversal attacks where relative paths like ../../etc/passwd are resolved correctly by the operating system despite being passed through the application layer without sanitization.
The operational impact of this vulnerability is severe, as it effectively bypasses the database's internal security model to compromise the host environment. Attackers can exfiltrate sensitive information such as database credentials, encryption keys, and other secrets stored in configuration files or environment variables located on the server filesystem. Furthermore, by writing executable files or modifying critical system configurations, an attacker could achieve remote code execution with root privileges. This transforms a simple SQL injection-like scenario into a full host compromise, potentially leading to lateral movement within the network if the compromised database server is part of a larger infrastructure cluster. The ability to read arbitrary files also facilitates reconnaissance, allowing attackers to map out the system architecture and identify further targets for exploitation.
To mitigate this risk, organizations running RisingWave must immediately upgrade to version 3.1.0 or later where these authorization checks have been strengthened. For environments that cannot be patched instantly, it is crucial to restrict SQL privileges carefully, ensuring that only trusted administrators can create sources and sinks involving file system interactions. Additionally, implementing strict network segmentation limits the exposure of database ports to untrusted networks. Running the RisingWave service with minimal necessary permissions using principles like least privilege can also reduce the blast radius if an attacker manages to exploit this flaw. Regular auditing of user privileges and monitoring for unusual SQL commands related to external data connectors are recommended defensive measures until a permanent fix is applied. This vulnerability aligns with ATT&CK techniques involving T1530 Data from Local System, as it involves reading files not directly owned by the current process or user context, highlighting the importance of robust input validation in database connectivity components.