Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112262— RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

Quick assessment

Affected
risingwavelabs risingwave
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

3.1.0 之前的 RisingWave 存在一个缺失授权（missing authorization）的漏洞，允许低权限 SQL 用户通过创建 posix_fs 数据源和 fs 数据输出，读写任意的服务器文件。拥有 schema CREATE 权限的攻击者可以将 posix_fs.root 或 fs.path 设置为任意目录，从而读取凭证和密钥，或以 root 用户身份写入文件。

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
risingwavelabs risingwave < 3.1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112262

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors
Source: CVE Program / CVE List V5
Vulnerability Description
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
risingwavelabs risingwave 0 ~ 3.1.0 -

II. Public POCs for CVE-2026-112262

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112262

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112262 (3)

Vendor Pages for CVE-2026-112262 (3)

IV. Related Vulnerabilities

Same weakness: CWE-862

V. Comments for CVE-2026-112262

No comments yet

Leave a comment