Daily Digest
The most urgent item this cycle is Oracle Database's Portable Clusterware component, which carries two distinct CVSS 9.6 (CRITICAL) vulnerabilities (CVE-2026-71063 and CVE-2026-71064) allowing unauthenticated attackers with adjacent physical network access to achieve full takeover with scope change — a rare and severe combination that could cascade beyond the clusterware itself. No CISA KEV entries appear in this dataset, so theoretical severity drives prioritization. PostgreSQL operators using CloudNativePG should also prioritize the two high-severity flaws (CVE-2026-55765, CVE-2026-55769) that expose superuser credentials and enable OS command execution in Kubernetes pods. MySQL Cluster and Connectors, MongoDB-adjacent applications (Rocket.Chat, n8n), and baserCMS round out the list with HIGH/MEDIUM issues primarily enabling DoS or data disclosure.
Summary: An unauthenticated, network-reachable attacker can exploit the MySQL Cluster NDB Operator component to cause a complete denial of service (hang or repeatable crash) and perform unauthorized data modification (insert/update/delete) on accessible cluster data. Affected versions span 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1.
Affected Features / Interoperability: MySQL Cluster NDB Operator; impacts cluster availability and data integrity. Downstream replication, client applications, and any services dependent on Cluster uptime would be disrupted.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: A difficult-to-exploit vulnerability in the MySQL Cluster General component allows an unauthenticated attacker with network access via HTTP to compromise the cluster, but requires human interaction (e.g., a user clicking a link). Successful exploitation leads to full takeover of MySQL Cluster. Affected versions: 8.0.0–8.0.48, 8.4.0–8.4.11, 9.7.0–9.7.2.
Affected Features / Interoperability: MySQL Cluster General (HTTP-facing component); potential impact on any web-based management or monitoring interfaces.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: An unauthenticated attacker with local logon access to the infrastructure hosting MySQL Connectors (Connector/ODBC 26.7.0) can cause a complete DoS of the connector and read a subset of its accessible data.
Affected Features / Interoperability: MySQL Connector/ODBC 26.7.0; impacts applications using this driver for database connectivity.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: A low-privileged, network-authenticated attacker can cause a complete DoS of MySQL Connector/ODBC 26.7.0 via multiple protocols.
Affected Features / Interoperability: MySQL Connector/ODBC 26.7.0; availability impact on client applications using the driver.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: An unauthenticated attacker with local logon access can trigger a DoS of MySQL Connector/ODBC 26.7.0, but requires human interaction (e.g., user action).
Affected Features / Interoperability: MySQL Connector/ODBC 26.7.0.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: CloudNativePG versions before 1.28.4, 1.29.2, and 1.30.0 embed cleartext role passwords in `ALTER ROLE`/`CREATE ROLE` statements. When `pg_stat_statements` is preloaded with `track_utility` enabled, an untrusted tenant with `pg_monitor` or `pg_read_all_stats` can recover superuser or application-owner passwords, reconnect via superuser TCP access, and execute OS commands via `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets are not affected.
Affected Features / Interoperability: CloudNativePG (PostgreSQL operator for Kubernetes); impacts password management, `pg_stat_statements` visibility, superuser access, and pod-level OS command execution. Downstream: any workloads relying on CloudNativePG-managed roles and secrets.
Source: https://github.com/cloudnative-pg/cloudnative-pg/commit/2f0342747e1f160425b9d51753c0069b0d6117d5, https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.4
Actions:
Summary: baserCMS before 5.3.0 has a SQL injection in `BcDatabaseService.php` allowing authenticated administrators to inject table names and configuration values into SQL statements (sequence update, CSV export, table management). This can be chained with a backup-restore code injection flaw (PHP code in schema files executes on load) to plant malicious table names and trigger error-based SQL injection, extracting database version, schema, and arbitrary data from PostgreSQL.
Affected Features / Interoperability: baserCMS admin panel (backup/restore, CSV export, table/sequence management); PostgreSQL backend data confidentiality and integrity.
Source: https://github.com/baserproject/basercms/releases/tag/5.3.0, https://github.com/baserproject/basercms/security/advisories/GHSA-cg65-f2m7-9fqj, https://www.vulncheck.com/advisories/basercms-sql-injection-and-code-injection-via-bcdatabaseservice-php
Actions:
Summary: CloudNativePG before 1.28.4, 1.29.2, and 1.30.0 opens superuser connections without pinning `search_path`. A role with `DATABASE OWNER` can create overloaded built-in operators in `public` schema and manipulate `search_path`, causing instance-manager introspection queries (e.g., `pg_extension` checks) to execute attacker-controlled functions as `postgres` superuser. This also affects direct `sql.Open("pgx", ...)` calls and the `public.user_search` SECURITY DEFINER function, enabling superuser access, OS command execution via `COPY ... FROM PROGRAM`, and pod ServiceAccount token access.
Affected Features / Interoperability: CloudNativePG instance manager, connection pooling, `pgx` driver usage, `public.user_search` function; leads to full PostgreSQL superuser compromise, pod escape via OS commands, and Kubernetes ServiceAccount token theft.
Source: https://github.com/cloudnative-pg/cloudnative-pg/commit/02b5c6289b7609dc87fcb1ae9c113160e3d43308, https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.4
Actions:
Summary: An unauthenticated attacker with access to the physical communication segment (adjacent network) where Portable Clusterware executes can compromise it, with scope change potentially impacting additional products. Full takeover of Portable Clusterware is possible. Affected: 19.3–19.32, 21.3–21.23, 23.4.0–23.26.3.
Affected Features / Interoperability: Oracle Portable Clusterware (cluster interconnect/management); scope change implies potential impact on Oracle RAC, ASM, or other clustered database components.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: Separate but identical-severity vulnerability in Portable Clusterware with same vector and impact: unauthenticated adjacent-network attacker achieves full takeover with scope change. Affected versions identical to CVE-2026-71063.
Affected Features / Interoperability: Portable Clusterware; same scope-change implications.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: An unauthenticated, network-reachable attacker via HTTP can compromise Portable Clusterware, gaining unauthorized creation/deletion/modification of critical data and causing complete DoS. Affected: 19.3–19.32, 21.3–21.23, 23.4.0–23.26.3.
Affected Features / Interoperability: Portable Clusterware HTTP interface; data integrity and availability of cluster management.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: A low-privileged, authenticated attacker with network access via Oracle Net can exploit the RDBMS component (version 23.4.0–23.26.3) to achieve takeover with scope change. Requires high attack complexity.
Affected Features / Interoperability: Oracle RDBMS core; scope change suggests impact beyond the database instance (e.g., linked servers, external procedures).
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: An unauthenticated, network-reachable attacker via Oracle Net can read a subset of RDBMS-accessible data. Affected: 19.3–19.32, 21.3–21.23, 23.4.0–23.26.3.
Affected Features / Interoperability: Oracle RDBMS listener/protocol; data confidentiality.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: Rocket.Chat before multiple versions (8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, 7.10.15) has a NoSQL injection in Meteor DDP methods `getThreadsList` and `getThreadMessages`. Untyped `rid`/`tmid` parameters accept MongoDB operator objects (e.g., `{"$gt": "4"}`), allowing low-privilege authenticated users to bypass authorization checks and disclose private threads and replies across all rooms. The REST route was patched in v5.0 but the DDP method was not.
Affected Features / Interoperability: Rocket.Chat DDP (real-time API) methods; MongoDB query layer. Impacts message confidentiality in multi-tenant Rocket.Chat deployments.
Source: https://github.com/RocketChat/Rocket.Chat/pull/41814, https://hackerone.com/reports/3852135
Actions:
Summary: n8n before 1.123.69, 2.33.4, and 2.34.1 has a NoSQL injection in the MongoDB node's Find, Delete, and Aggregate operations. The Query parameter is parsed as JSON after expression resolution without sanitizing MongoDB operators (`$ne`, `$where`, etc.), allowing attackers who control resolved query data to escalate single-document lookups into full-collection disclosure or deletion.
Affected Features / Interoperability: n8n workflow automation MongoDB node; impacts any workflows accepting external input into MongoDB query parameters.
Source: https://github.com/n8n-io/n8n/security/advisories/GHSA-953p-jm2c-8h5j, https://www.vulncheck.com/advisories/n8n-before-nosql-injection-via-mongodb-node
Actions:
MySQL
Oracle Database
Note: News items are unverified chatter and supplementary to the formal vulnerability data above.
The most urgent threat is CVE-2026