Daily Digest
This cycle's database security landscape is dominated by two high-severity issues in PostgreSQL's pglogical extension (CVE-2026-50736 and CVE-2026-50737, both CVSS 7.5) that enable privilege escalation from a limited pglogical role to full superuser, combined with a SQL injection vector in the popular TypeORM library (CVE-2026-76848, CVSS 7.5) that could expose data beyond an application's intended access scope. For MySQL, the most actionable item is a cross-site scripting flaw in Adminer (CVE-2026-56704, CVSS 6.1) where a rogue MySQL server can weaponize crafted version strings against Adminer clients. No CISA KEV-confirmed active exploitation entries are present this cycle.
Summary: Adminer before version 5.4.3 is vulnerable to a stored cross-site scripting (XSS) attack via the MySQL server version string. When a client connects through Adminer to a MySQL server controlled by an attacker, that server can return a crafted version string containing JavaScript payload. Adminer inserts this string into script tags that have valid Content Security Policy nonces, effectively bypassing CSP protections and executing arbitrary code in the victim's browser. Any user who accesses Adminer while connected to the malicious server is vulnerable.
Affected Features / Interoperability: Adminer's database connection interface and its handling of server metadata. The vulnerability does not affect the MySQL server itself but rather the Adminer client tool. Downstream impact is limited to Adminer users; no direct MySQL server compromise occurs.
Source: https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj, https://www.vulncheck.com/advisories/adminer-before-cross-site-scripting-via-mysql-version-string
Actions:
Summary: Oracle MySQL Connectors/ODBC version 26.7.0 contains a vulnerability that allows a local attacker with logon access to the system where the connector runs to cause a denial of service (complete hang or crash). Exploitation requires human interaction and local access; it cannot be exploited remotely without first compromising the endpoint.
Affected Features / Interoperability: The MySQL Connector/ODBC component specifically. Downstream impact includes any application relying on ODBC connectivity to MySQL databases; service disruption would affect database-dependent applications using this connectivity method.
Source: https://www.oracle.com/security-alerts/cspuaug2026.html
Actions:
Summary: The pglogical replication extension's queue mechanism, which handles out-of-band commands like replicated DDL from publisher to subscriber, executes message payloads at the subscriber's apply worker privilege level—equivalent to a PostgreSQL superuser by default. An attacker controlling a publisher can send crafted queue messages to cause arbitrary SQL execution on the subscriber as superuser, achieving full database compromise from a role permitted to use pglogical. In typical deployments, exploiting this requires superuser-level subscription creation privileges, making this most relevant to managed environments where such privileges have been delegated to non-superuser roles.
Affected Features / Interoperability: pglogical replication extension, specifically the queue command delivery mechanism between publisher and subscriber nodes. This breaks tenant isolation in shared deployments and can compromise the entire subscriber database. Integrations relying on pglogical for logical replication are at risk.
Source: https://www.enterprisedb.com/docs/security/advisories/cve202650736/
Actions:
Summary: pglogical's apply worker executes default column expressions on the subscriber at superuser privilege level by default. An attacker controlling a publisher can send replicated rows that trigger these default expressions, causing arbitrary functions to execute as superuser on the subscriber. This is an independent privilege escalation path separate from CVE-2026-50736, targeting the default expression evaluation mechanism rather than the queue command mechanism. Same conditions and audience apply.
Affected Features / Interoperability: pglogical replication, specifically row apply processing and default expression evaluation on subscriber nodes. Affects tables with DEFAULT expressions involving functions. Downstream risk is identical to CVE-2026-50736: full superuser compromise of the subscriber.
Source: https://www.enterprisedb.com/docs/security/advisories/cve202650737/
Actions:
Summary: TypeORM's SelectQueryBuilder.distinctOn accepts raw user input without validation or escaping. For PostgreSQL-family drivers, this unsanitized input is interpolated directly into a `SELECT DISTINCT ON` SQL expression without going through identifier escaping or the driver's escape helpers. An attacker who can control the distinctOn parameter (for example, through an API that allows callers to specify deduplication columns) can inject arbitrary SQL expressions including correlated subqueries. This allows reading data anywhere the application's database role has access, bypassing the intended entity-level access controls.
Affected Features / Interoperability: TypeORM's SelectQueryBuilder component when used with PostgreSQL, specifically the distinctOn functionality. Applications that expose distinctOn to untrusted callers are vulnerable. Downstream impact includes unauthorized data disclosure across any tables the application's database role can access, regardless of the queried entity's intended permissions.
Source: https://github.com/typeorm/typeorm, https://www.vulncheck.com/advisories/typeorm-through-sql-injection-via-selectquerybuilder-distincton
Actions:
Summary: The Go pg library's DataRow.Decode function does not properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message containing a negative field length value, causing a slice bounds out of range panic on the client side. This crashes the client application, resulting in a denial of service for any application using the pg library to connect to the malicious server.
Affected Features / Interoperability: The pg (jackc/pgx) Go library's protocol parsing, specifically DataRow message handling. Applications written in Go using this library to connect to PostgreSQL are affected. Downstream impact includes client-side crashes causing application unavailability.
Source: https://github.com/advisories/GHSA-jqcq-xjh3-6g23, https://pkg.go.dev/vuln/GO-2026-4518
Actions:
Summary: A use-after-free condition exists in pglogical's worker signaling code. During normal replication operations, a worker structure can be dereferenced after its underlying slot has been freed or recycled. This is reachable by low-privileged users who can influence worker timing through permitted pglogical operations. In the typical case, this crashes replication workers, causing availability impact. In the worst case, a use-after-free in a PostgreSQL backend can potentially be leveraged for remote code execution at the backend's privilege level.
Affected Features / Interoperability: pglogical replication worker lifecycle management. Both availability (crash) and potential remote code execution scenarios are possible. In default installations, this runs at superuser-equivalent privilege, making it a high-impact issue despite the medium CVSS.
Source: https://www.enterprisedb.com/docs/security/advisories/cve202650738/
Actions:
Summary: phpMyFAQ before version 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, incorrectly declares an ESCAPE character ('=') in its LIKE query handling while the escape function actually prefixes wildcards with '|'. This makes wildcard escaping ineffective, leaving user-supplied `%` and `_` characters active. An unauthenticated attacker can submit these wildcards in the public FAQ search form to force broad pattern matches and expensive sequential scans, causing denial of service. The PDO PostgreSQL backend is unaffected, and this does not enable SQL injection or data exfiltration—it's strictly a DoS vector via wildcard injection.
Affected Features / Interoperability: phpMyFAQ's search functionality when using the native pgsql PHP extension for PostgreSQL. Does not affect phpMyFAQ with PDO PostgreSQL backend. Downstream impact is limited to search availability; no data access or modification is possible through this path.
Source: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5hx6-c293-588h
Actions:
The most urgent item in this cloud security digest is CVE-2026-17107, a HIGH-severity vulnerability in Kubernetes multi-cluster management that enables an authenticated hub principal to escalate to cluster-admin on every managed cluster. While no CISA KEV-confirmed active exploitation is present in the current data, this flaw represents a critical trust boundary break in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE) environments. Other notable issues include a Docker Engine daemon code execution flaw (CVE-2026-41567) and an Apache CloudStack cross-tenant access control weakness (CVE-2026-62440), but the Kubernetes privilege escalation poses the most immediate risk to cloud infrastructure with multi-cluster orchestration.
Summary: A flaw in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE) allows an authenticated hub principal to inject an `Impersonate-Group` header and escalate to cluster-admin on every managed cluster. The vulnerability arises because the service-proxy appends impersonation group headers without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions.
Affected Features / Interoperability: The cluster-proxy service-proxy component is directly impacted. This weakness undermines the trust model between hub and spoke clusters, potentially breaking multi-cluster policy enforcement, resource synchronization, and centralized management functions. Any integration relying on the spoke ServiceAccount's impersonation capabilities could be subverted.
Source:
Actions:
Summary: Improper validation of Kubernetes client certificate renewal in Open Cluster Management (OCM) enables a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This allows cross-cluster privilege escalation and may give an attacker control over other managed clusters, including the hub cluster.
Affected Features / Interoperability: The OCM controller's certificate approval process is impacted. This flaw could break the certificate-based trust between managed clusters and the hub, compromising multi-cluster isolation and enabling lateral movement across clusters.
Source:
Actions:
Summary: In Contour ingress controller versions 1.23.0 through 1.33.4, an `HTTPProxy` resource configured with both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProviders` is not rejected. This allows clients that send no TLS SNI or an unrecognized SNI to bypass JWT verification and be proxied to upstream services without a valid token. The issue is fixed in Contour v1.33.5.
Affected Features / Interoperability: Contour's TLS fallback certificate and JWT provider features are impacted. Downstream, this can allow unauthenticated requests to reach services behind the ingress, breaking JWT-based access control for affected virtual hosts.
Source:
Actions:
Summary: An improper access control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin allows cross-tenant manipulation of a Kubernetes cluster while adding and removing nodes. This affects CloudStack versions 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.22.1.1 or later.
Affected Features / Interoperability: The CloudStack CKS plugin's node management functionality is impacted. This could break multi-tenant isolation, allowing one tenant to interfere with another cluster's node lifecycle and potentially compromise cluster integrity.
Source:
Actions:
Summary: A vulnerability in Docker Engine (Moby) allows arbitrary code execution with full daemon privileges when a user uploads a compressed archive (xz or gzip) into a container that contains a trojanized decompression binary. The daemon incorrectly resolves decompression binaries from the container's filesystem instead of the host. This is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14.
Affected Features / Interoperability: The container archive upload functionality (`PUT /containers/{id}/archive` and `docker cp`) is impacted. This could allow container escape and host compromise, breaking isolation between containers and the host operating system.
Source:
Actions:
Summary: A vulnerability in Docker Engine's plugin installation process allows the daemon to incorrectly accept a privilege set that differs from the one approved by the user, bypassing privilege validation. Plugins that request exactly one privilege are also affected because no comparison is performed. This is patched in version 29.3.1.
Affected Features / Interoperability: Docker plugin installation and privilege validation mechanisms are impacted. This could allow a plugin to gain more privileges than intended, potentially leading to host compromise or unauthorized access to Docker resources.
Source:
Actions:
Summary: Renovate versions prior to 42.96.3 (and prior to 43.4.4 for the 43.x branch) fail to restrict environment variables to an allowlist when spawning child processes. This allows child processes (e.g., `npm install`, post-upgrade tasks) to inherit all environment variables of the Renovate process, potentially exposing secrets to insider or outside attackers.
Affected Features / Interoperability: Renovate's child process spawning and environment variable handling are impacted. Downstream, this could lead to credential leakage and unauthorized access to integrated services that rely on secrets stored in the Renovate process environment.
Source:
Actions:
The following items are unverified news and community chatter and should not be treated as authoritative vulnerability data.