Read the docs
TI-2026-76281 Aliases CVE-2026-111439GHSA-cr5j-x763-5676

Missing permission check in openGauss lets users read table file blocks

Priority LOW 20CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

openGauss-server versions 3.0.0-3.0.5, 3.1.0-3.1.1, 5.0.0-RC1, 5.0.0-5.0.3, 5.1.0, 6.0.0-RC1, 6.0.0-6.0.6, 7.0.0-RC1, 7.0.0-RC2 and 7.0.0-RC3 are listed as affected. The pg_read_binary_file_blocks function checks only the start block number and block count, and the underlying file read routine does not check the caller's table privileges (CWE-862). Any user with a normal database login who can obtain a relation file path, such as with pg_relation_filepath(), can read raw table data blocks without SELECT permission on the table.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file() 也仅用于识别文件形态，未包含权限检查。因此，任何拥有普通数据库连接权限的用户，只要能够通过 pg_relation_filepath() 等函数获取到目标表的底层关系文件路径（例如压缩数据的 _compress 文件路径），即可无需具备该表的 SELECT 权限，直接读取表数据的二进制块。 此漏洞影响此前3.0.0到6.0.0间的所有版本及补丁版，并在7.0.0-LTS版本修复。修复patch详见：https://gitcode.com/opengauss/openGauss-server/pull/9374。

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00259 17th percentileScored 2026-11-07
Fix Fixed openGauss-server (openGauss-server): 7.0.0-LTS

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openGauss-serveropenGauss-server3.0.0-3.0.5; 3.1.0-3.1.1; 5.0.0-RC1; 5.0.0-5.0.3; 5.1.0; 6.0.0-RC1; 6.0.0-6.0.6; 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC37.0.0-LTSPatch availableCNA
  • openGauss-server VendoropenGauss-server Affected 3.0.0-3.0.5; 3.1.0-3.1.1; 5.0.0-RC1; 5.0.0-5.0.3; 5.1.0; 6.0.0-RC1; 6.0.0-6.0.6; 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 Fixed in 7.0.0-LTS Patch available CNA

Remediation

Upgrade openGauss-server to 7.0.0-LTS, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA openGauss-server (openGauss-server) Fixed in 7.0.0-LTS

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111439
  2. 2026-10-19 Alias added: GHSA-cr5j-x763-5676
  3. 2026-10-19 CISA SSVC decision points changed

References

Other 1

  • TI-2026-76229 Heap overflow in openGauss HLL unpacking from missing length check CVSS 3.1HIGH 8.1
  • TI-2026-76236 Unsafe reflection in openGauss JDBC LogFactory enables class loading CVSS 3.1HIGH 7.0
  • TI-2026-76280 Authentication bypass in openGauss-server replication connections CVSS 3.1MEDIUM 6.5
  • TI-2026-12011 openGauss存在非法内存访问导致DoS漏洞 CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences