Loading story…
A critical flaw in StackGres allowed a low-privilege tenant who owns a PostgreSQL database to escalate to remote code execution in the primary PostgreSQL pod through the platform’s default metrics exporter. The issue was reported by Cipher of Causal Security and tracked in GitLab as a tenant DB-owner to pod RCE path affecting StackGres 1.x through 1.18.8 and the referenced 1.19.0-SNAPSHOT build. According to the report, the exporter connected as the cluster superuser and, during Prometheus scrapes, opened superuser dblink sessions into tenant databases.
The exploit relied on the exporter executing remote SQL with unqualified object references while failing to pin search_path, allowing an attacker to set a database-level search_path and create shadow objects such as a malicious version() function. When the exporter’s superuser session resolved those objects, it could be driven into attacker-controlled execution and ultimately reach PostgreSQL primitives such as COPY ... TO PROGRAM for operating-system command execution inside the pod. The vulnerability was later discussed as fixed and released in StackGres 1.19.0 GA, and a CVE request was subsequently submitted through GitLab’s process.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The report states that the per-database superuser dblink fan-out behavior in StackGres has existed since 2024-01, creating the conditions for later exploitation via unpinned search_path handling in metrics exporter queries.
After the fix was released in StackGres 1.19.0 GA, a CVE ID request was created through GitLab's process for the vulnerability.
The GitLab issue discussion indicates that a fix for the vulnerability was merged and later released in StackGres 1.19.0 GA, making that release the first stated fixed version.
Cipher of Causal Security reported a critical vulnerability in StackGres through a GitLab issue. The issue describes how a low-privilege tenant who owns a PostgreSQL database can achieve remote code execution in the primary PostgreSQL pod via the default metrics exporter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2026-6471** (“PostGREShell”) is a CVSS 7.2 missing-authorization flaw in PostgreSQL logical decoding that lets a non-superuser account with the `REPLICATION` privilege provide an arbitrary filesystem path as an output-plugin name. PostgreSQL then loads the selected shared library via `dlopen()` and executes it as the `postgres` operating-system user, enabling database-server takeover. The vulnerability reportedly existed since PostgreSQL 9.4 and affects releases through PostgreSQL 18 before remediation. Exploitation can yield operating-system command execution, permanent PostgreSQL superuser escalation, access across databases, accessible private-key theft, and persistent backdoors. PostgreSQL fixed the issue in versions **18.6, 17.11, 16.15, 15.19, and 14.24**; organizations should update affected deployments and review or remove unnecessary `REPLICATION` privileges.
Sep 7, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026