CVE-2026-112262 — RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources…
Published: 2026-10-19 · CVSS: 7.1 · CVSS 4.0
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7