openGauss Server CVE-2026-111439

Requires an authenticated attacker holding any ordinary openGauss database connection (a valid low-privilege account); it is NOT remote-unauthenticated. The attacker must be able to call the built-in functions pg_relation_filepath() to obtain the target table's underlying relation file path (including compressed _compress file paths) and pg_read_binary_file_blocks() to read the raw blocks. The decisive missing control is that ReadBinaryFileBlocksFirstCall() and is_row_data_file() perform only path normalization, '..' traversal, and data-directory boundary checks - not a caller SELECT-permission check. Limiting factors: a valid database account is required; only openGauss-server versions 3.0.0 through 6.0.0 (and their patch builds) are affected, with the flaw fixed in 7.0.0-LTS; and the returned data is raw binary blocks that an attacker must parse/reconstruct to recover meaningful rows.

This is a genuine but moderate-priority authorization flaw (CWE-862 Missing Authorization). The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: exploitation is over the network via a normal database session (AV:N), is low-complexity (AC:L), but requires an authenticated low-privilege account (PR:L), with confidentiality-only impact (C:L, I:N, A:N). No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. The only reference is the vendor fix (PR 9374), which is a patch, not weaponized exploit code - therefore no public exploit identified at time of analysis. Signals are consistent rather than conflicting: a medium CVSS, no KEV, no POC, and a confidentiality-only impact all point to a real-but-not-urgent insider/multi-tenant data-exposure risk rather than a mass-exploitation threat. One caveat worth noting: the C:L rating arguably understates impact, since the flaw lets an authenticated user read the raw binary blocks of ANY table (bypassing SELECT), which in a multi-tenant or least-privilege database could expose high-value data - defenders handling sensitive data stores should treat the confidentiality impact as potentially higher than the base score implies.

A low-privileged user holding only a normal openGauss database connection - but lacking SELECT permission on a sensitive table - calls pg_relation_filepath() to resolve that table's underlying relation file path (including _compress files for compressed data), then invokes pg_read_binary_file_blocks() to read its raw binary blocks directly, bypassing the missing SELECT authorization check and exfiltrating data they are not entitled to see. Because AV:N/AC:L applies, this requires only an authenticated session and simple SQL calls. No public exploit is identified; the vendor patch is available in PR 9374.