# CVE-2026-111439: openGauss authorization bypass in pg_read_binary_file_blocks

Source: https://junglewise.ai/threats/cve-2026-111439-opengauss-server-src-common-backend-utils-adt-genfile-cpp-pg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-111439 · Severity: medium · CVSS 4.3 · Published 2026-10-19

openGauss is an open-source relational database that stores data in binary block files. A built-in function called pg_read_binary_file_blocks() lacks proper permission checks, allowing any database user to read raw binary data from tables they should not have access to. An attacker with basic database login credentials could bypass table-level access controls to directly read sensitive table data.

Vendors: [openGauss](https://junglewise.ai/threats/vendors/opengauss).

## Quick answers

**Is CVE-2026-111439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111439 being exploited in the wild.

**How severe is CVE-2026-111439?** Medium severity, with a CVSS score of 4.3, published 19 October 2026.

**Which products and versions are affected?** openGauss 3.0.0 through 6.0.0 (all patch versions).

**Is there a fix for CVE-2026-111439?** Yes: fixed in 7.0.0-LTS and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111439 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111439?** Check whether you run openGauss at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.0.0-LTS and later

## Technical details

The pg_read_binary_file_blocks() function in src/common/backend/utils/adt/genfile.cpp validates block number and count ranges but fails to verify that the caller holds SELECT permission on the target table. The underlying ReadBinaryFileBlocksFirstCall() routine only checks path normalization and basic directory boundary validation, missing database permission enforcement. An authenticated database user can obtain the relation file path via pg_relation_filepath() and directly read table binary blocks without SELECT privilege.

## Affected products

- openGauss openGauss 3.0.0 through 6.0.0 (all patch versions)

## Timeline

- 2026-10-19: disclosed
- 2026-07-02: patched: Fix merged in PR #9374

## References

- [https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS)](https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS))
- [https://gitcode.com/opengauss/openGauss-server/pull/9374](https://gitcode.com/opengauss/openGauss-server/pull/9374)

## Related threats

- [openGauss HllObjectUnpack buffer overflow in HLL parsing](https://junglewise.ai/threats/cve-2026-111441-opengauss-server-src-gausskernel-cbb-utils-hll-hll-cpp)