Risingwave
Monthly
Missing authorization in RisingWave before 3.1.0 allows any authenticated low-privilege SQL user with CREATE privilege on a schema to create posix_fs sources or fs sinks that point at arbitrary server filesystem paths, enabling theft of credentials and keys and creation of files with the RisingWave process's privileges. The vendor CVSS 4.0 score is 7.1 (High); the prerequisite is only a valid SQL account with schema CREATE, and no user interaction or special victim-side configuration is needed in affected releases. RisingWave 3.1.0 fixes this by gating local filesystem connectors behind frontend.unsafe_enable_local_fs_connector, which defaults to false in release builds; no public exploit code or active exploitation is identified in the supplied intelligence.
Missing authorization in RisingWave before 3.1.0 allows any authenticated low-privilege SQL user with CREATE privilege on a schema to create posix_fs sources or fs sinks that point at arbitrary server filesystem paths, enabling theft of credentials and keys and creation of files with the RisingWave process's privileges. The vendor CVSS 4.0 score is 7.1 (High); the prerequisite is only a valid SQL account with schema CREATE, and no user interaction or special victim-side configuration is needed in affected releases. RisingWave 3.1.0 fixes this by gating local filesystem connectors behind frontend.unsafe_enable_local_fs_connector, which defaults to false in release builds; no public exploit code or active exploitation is identified in the supplied intelligence.