risingwave vulnerabilities

CVEs whose affected-version data names the risingwave package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112262High· 7.1

today

RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can…

▾ Twilightrisingwavelabs · risingwavevia CVEORG