CVE-2026-111439
MediumCVSS 4.3Summary
In openGauss-server, the built-in function pg_read_binary_file_blocks() in src/common/backend/utils/adt/genfile.cpp has a permission check flaw. The function only validates the range of startBlockNum and blockCount, then calls ReadBinaryFileBlocksFirstCall(), which does not verify the caller's SELECT privileges. Any user with ordinary database connection access can read binary blocks of table data without SELECT permission if they know the relation file path.
Risk Assessment
A user without SELECT privileges can read table data, violating confidentiality and access control. The vulnerability affects versions 3.0.0 through 6.0.0 and is fixed in 7.0.0-LTS.
Recommendation
Update openGauss-server to version 7.0.0-LTS or later, which includes the fix. If updating is not possible, restrict access to pg_read_binary_file_blocks() and monitor for unusual file reads.
Other vulnerabilities in openGauss-server
See all- CVE-2026-111438Medium
In openGauss-server, src/common/backend/libpq/hba.cpp contains an access control bypass in replication connection authentication. hba_getauthmethod() for HADR/SW replication senders does not require is_node_internal_connection() and calls check_hba_replication(), which only performs weak matching on the replication flag, skipping full pg_hba checks (including the remote trust prohibition). This allows external replication connections to bypass internal connection restrictions and full pg_hba policy, enabling reading of backup and log data via the replication protocol.
- CVE-2026-111441High
In openGauss-server's hll.cpp, the HllObjectUnpack() function has a length validation flaw. After parsing lenUsed and lenTotal from user-supplied packed HLL, it only checks that input length covers HLL_HEAD_SIZE + lenUsed, then allocates a buffer by lenTotal and copies via memcpy_s() by lenUsed, without validating lenTotal >= lenUsed and passing lenUsed instead of lenTotal as destination size. A regular database user can craft a malformed packed HLL (e.g., via ::hll into hll_in()) to trigger a server-side heap overflow.
Original NVD description (English source)
在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file() 也仅用于识别文件形态，未包含权限检查。因此，任何拥有普通数据库连接权限的用户，只要能够通过 pg_relation_filepath() 等函数获取到目标表的底层关系文件路径（例如压缩数据的 _compress 文件路径），即可无需具备该表的 SELECT 权限，直接读取表数据的二进制块。 此漏洞影响此前3.0.0到6.0.0间的所有版本及补丁版，并在7.0.0-LTS版本修复。修复patch详见：https://gitcode.com/opengauss/openGauss-server/pull/9374。
Vulnerability data from NVD (NIST) · CISA KEV · EPSS