aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration
Priority MEDIUM 40CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack of search_path restriction, an attacker can override pg_catalog and execute untrusted operators as a superuser. This vulnerability is fixed in 1.0.7.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00723 54th percentileScored 2026-11-07
Fix Fixed aiven-db-migrate (aiven): 1.0.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Aiven-Open | aiven-db-migrate | before 1.0.7 | 1.0.7 | Patch available | CNA |
- aiven-db-migrate VendorAiven-Open Affected before 1.0.7 Fixed in 1.0.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aiven:aiven-db-migrate:*:*:*:*:*:*:*:* | before 1.0.7 | Vulnerable | Aiven-Open |
- cpe:2.3:a:aiven:aiven-db-migrate:*:*:*:*:*:*:*:* Versions before 1.0.7 Vulnerable ·Aiven-Open
Remediation
- Fix · CNA aiven-db-migrate (aiven) Fixed in 1.0.7
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55282
References
More Aiven-Open Aiven-db-migrate vulnerabilities
- TI-2025-34940 aiven-db-migrate allows Privilege Escalation through use of psql during migration CVSS 3.1CRITICAL 9.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences