RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks.
CVSS 4.0HIGH 7.1·Network·Low privileges·No interaction·EPSS 0.00288·Published 2026-10-19·Fixed in 3.1.0CWE-862