{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arisingwaverisingwave/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:risingwave:risingwave:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-112262"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RisingWave (\u003c 3.1.0)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","database-security"],"_cs_type":"advisory","_cs_vendors":["RisingWave"],"content_html":"\u003cp\u003eRisingWave versions prior to 3.1.0 are affected by a missing authorization vulnerability, tracked as CVE-2026-112262. The flaw resides in the handling of filesystem-based data sources and sinks, specifically \u003ccode\u003eposix_fs\u003c/code\u003e sources and \u003ccode\u003efs\u003c/code\u003e sinks. An attacker possessing the \u003ccode\u003eCREATE\u003c/code\u003e privilege on a schema can manipulate the \u003ccode\u003eposix_fs.root\u003c/code\u003e or \u003ccode\u003efs.path\u003c/code\u003e parameters to point to arbitrary directories on the underlying host filesystem. By exploiting this, a low-privileged SQL user can bypass intended access controls to read sensitive files, such as credentials and private keys, or perform arbitrary write operations. Given that the RisingWave service may operate with elevated privileges, this vulnerability enables the execution of unauthorized filesystem modifications, potentially resulting in full system compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privileged SQL users to gain unauthorized access to any file accessible by the RisingWave process. In configurations where the service runs with root privileges, this results in immediate system-level compromise. The vulnerability is particularly dangerous for multi-tenant environments or instances where untrusted users are granted schema creation rights, as it allows for credential exfiltration and unauthorized file manipulation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade RisingWave to version 3.1.0 or later immediately to remediate CVE-2026-112262.\u003c/li\u003e\n\u003cli\u003eAudit database user permissions to restrict \u003ccode\u003eCREATE\u003c/code\u003e privileges on schemas to trusted users only.\u003c/li\u003e\n\u003cli\u003eEnforce strict filesystem-level permissions for the service account running RisingWave to limit the impact of potential arbitrary file read or write operations.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T16:08:18Z","date_published":"2026-10-19T16:08:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-risingwave-auth-bypass/","summary":"RisingWave versions before 3.1.0 contain a missing authorization vulnerability allowing low-privileged SQL users to perform arbitrary filesystem read and write operations.","title":"Missing Authorization Vulnerability in RisingWave","url":"https://feed.craftedsignal.io/briefs/2026-10-risingwave-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:risingwave:risingwave:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}