CVE-2026-111439
Received Received - Intake

Privilege Escalation in openGauss Server File Read Functions

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: openGauss Community

Description
在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file() 也仅用于识别文件形态，未包含权限检查。因此，任何拥有普通数据库连接权限的用户，只要能够通过 pg_relation_filepath() 等函数获取到目标表的底层关系文件路径（例如压缩数据的 _compress 文件路径），即可无需具备该表的 SELECT 权限，直接读取表数据的二进制块。 此漏洞影响此前3.0.0到6.0.0间的所有版本及补丁版，并在7.0.0-LTS版本修复。修复patch详见：https://gitcode.com/opengauss/openGauss-server/pull/9374。

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111439
EUVD
EUVD-2026-104112

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
openGauss-server openGauss-server 3.0.0-3.0.5
openGauss-server openGauss-server 3.1.0-3.1.1
openGauss-server openGauss-server 5.0.0-RC1
openGauss-server openGauss-server 5.0.0-5.0.3
openGauss-server openGauss-server 5.1.0
openGauss-server openGauss-server 6.0.0-RC1
openGauss-server openGauss-server 6.0.0-6.0.6
openGauss-server openGauss-server 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in openGauss-server's pg_read_binary_file_blocks() function which lacks proper permission checks. It allows users with basic database access to read binary data blocks from tables without needing SELECT privileges by exploiting file path retrieval functions like pg_relation_filepath().

Detection Guidance

To detect this vulnerability, check if your openGauss-server version is between 3.0.0 and 6.0.0 or an unpatched 7.0.0-LTS. Verify if the pg_read_binary_file_blocks() function lacks proper permission checks. Review database logs for unusual file read operations by non-privileged users.

Impact Analysis

An attacker with database access could read sensitive data from other tables without authorization. This includes accessing compressed data files or other restricted information, potentially leading to data breaches or unauthorized information disclosure.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive personal or health information stored in the database.

Mitigation Strategies

Upgrade openGauss-server to version 7.0.0-LTS or later to apply the patch fixing this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart