Loading story…
A critical vulnerability tracked as CVE-2025-71392 affects SurrealDB versions before 2.0.5, 2.1.5, and 2.2.2, allowing SurrealQL injection through the command-line export function. The flaw is caused by improper escaping of table and field names, enabling an authenticated user with OWNER or EDITOR privileges to create malicious object names that are written into exported backups.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
SurrealDB addressed a critical SurrealQL injection flaw in releases 2.0.5, 2.1.5, and 2.2.2. The issue affected earlier versions and involved improper escaping of table and field names in the command-line export function, enabling privilege escalation when a backup was later imported by a higher-privileged user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw in **StackGres** allowed a low-privilege tenant who owns a PostgreSQL database to escalate to **remote code execution** in the primary PostgreSQL pod through the platform’s default metrics exporter. The issue was reported by **Cipher** of Causal Security and tracked in GitLab as a tenant `DB-owner` to pod RCE path affecting StackGres **1.x through 1.18.8** and the referenced `1.19.0-SNAPSHOT` build. According to the report, the exporter connected as the cluster superuser and, during Prometheus scrapes, opened superuser `dblink` sessions into tenant databases. The exploit relied on the exporter executing remote SQL with unqualified object references while failing to pin `search_path`, allowing an attacker to set a database-level `search_path` and create shadow objects such as a malicious `version()` function. When the exporter’s superuser session resolved those objects, it could be driven into attacker-controlled execution and ultimately reach PostgreSQL primitives such as `COPY ... TO PROGRAM` for operating-system command execution inside the pod. The vulnerability was later discussed as fixed and released in **StackGres 1.19.0 GA**, and a **CVE** request was subsequently submitted through GitLab’s process.
Aug 23, 2026
Two disclosed SQL injection vulnerabilities affect **Saltcorn** and **Dagster**, allowing authenticated users to execute unintended database queries and access data beyond their assigned privileges. In Saltcorn, the flaw in mobile sync endpoints can bypass application-level authorization controls to extract arbitrary table contents, including sensitive records from `_sc_config` and bcrypt password hashes from the `users` table. The exposure can also include active administrative session identifiers in some deployments, creating a direct path to account takeover. The impact extends beyond data exposure in several configurations. Saltcorn deployments using PostgreSQL may permit stacked queries, enabling attackers to run DML or DDL statements that delete tables, alter configuration, and escalate from a low-privileged account to full administrative control. In Dagster, injected SQL runs with the privileges assigned to the platform's database credentials, which often include broad read, write, and delete access to warehouse data. The risk is particularly acute in Dagster OSS, where limited RBAC means users with API access may be able to trigger the flaw, while Dagster+ reduces default exposure but can still permit privilege escalation under custom RBAC settings.
Jun 29, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026