GCVE - cpe:2.3:a:risingwavelabs:risingwave:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:risingwavelabs:risingwave:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Risingwavelabs (`a5b04a26-faea-5a35-838b-570813cd2ec0`)
Product	Risingwave (`deeea140-e1b8-511e-8b46-bea7e5e3dfb0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-112262`	vulnerable	2026-11-03 10:16:28.565847	RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors HIGH (7.1) RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root. Published: 2026-10-19T13:55:13.053Z Updated: 2026-10-19T19:30:17.015Z Open on db.gcve.eu Reference links https://github.com/risingwavelabs/risingwave/pull/25971 https://github.com/risingwavelabs/risingwave/commit/4603a7ea5cc104fa9ca0779bc459bef630e7f621 https://github.com/risingwavelabs/risingwave/releases/tag/v3.1.0 https://github.com/risingwavelabs/risingwave/blob/v3.0.5/src/connector/src/source/filesystem/opendal_source/posix_fs_source.rs https://github.com/risingwavelabs/risingwave/blob/v3.0.5/src/connector/src/sink/file_sink/fs.rs	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.