Systemic Risks in the Managed PostgreSQL Industry - Mehmet Ince @mdisec - Vulnerability Researcher

A security researcher continues a series investigating privilege-escalation flaws in security-hardening extensions used by managed PostgreSQL providers (Supabase, Azure, Aiven, AWS Aurora, Google AlloyDB, NeonDB, PlanetScale, Xata). The piece details two case studies: a CREATE FOREIGN DATA WRAPPER validator bypass allowing superuser escalation, and a search_path-based OID confusion trick that fools extensions into executing attacker-controlled functions during elevated-privilege windows. It also covers bypassing blocked lo_export() via LANGUAGE internal and pg_proc.prosrc manipulation to achieve native code execution, and a type-confusion bug in LANGUAGE internal itself that undermines these hardening extensions entirely. The researcher reports 76 vulnerabilities found across vendors, thanks Supabase and Google Cloud VRP for their responses, and previews further PostgreSQL core findings in upcoming installments.

Source: https://postgr.es/p/9vw. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.

Recommended for you

Kogan.com0 Hot10 min10 h ago

Eventually Consistent: How Do We Know the Systems Eventually Agree?

Event-driven systems only agree eventually. Here’s how we check they actually got there: deadlines, data ownership, and a reconciliation job that walks the floor.

#architecture#postgresql#distributed-systemsSource

Hacker News69 Hot1 min8 d ago

OccupySaaS

OccupySaaS is a protest movement in code: laid-off developers building clean-room, open-source, drop-in replacements for the SaaS giants. First up: ZeroAuthy (Auth0) and SalesCompel (Salesforce).

#open-source#go#postgresqlSource

Planet PostgreSQL3 Hot15 min1 d ago

json vs jsonb in PostgreSQL: size and speed, measured

json vs jsonb in PostgreSQL 17 and 18, measured on six document shapes: when jsonb is 23% smaller or 41% larger, read speed, GIN, and what it changes.

#database#postgresqlSource

Milan Jovanović12 Hot10 min3 d ago

Outbox Pattern in .NET With Postgres: Concurrent Workers vs the WAL

An API can save an order and crash before publishing the message that tells other services about it.

#.net#postgresql#distributed-systemsSource

RUBYLAND0 Hot3 min22 h ago

A database per git worktree that barely uses any disk space

Postgres 18’s new file_copy_method = clone setting lets you give every git worktree its own copy of your database in seconds, without eating up your disk.

#linux#postgresqlSource

freeCodeCamp29 Hot16 min6 d ago

How to Automate Docker Image Creation for Postgres Using Shell Commands

If you have certain lines of code that repeat over and over again in a project, there's a pretty standard solution for it: using a function. But what about when you have the same project file setup th

#automation#docker#postgresqlSource

Planet PostgreSQL0 Hot8 min1 d ago

Two migrations collide: one loud failure, one silent one

Two incompatible migrations merge clean, then resolve in the database — as a failed deploy in one environment and a healthy one in another, decided by apply order. The idempotent version is worse: every statement succeeds and the schemas silently diverge.

#database#postgresql#mysqlSource

Medium16 Hot2 min6 d ago

Gemini 4 Carbon: Google’s New AI Takes the #1 Spot, But You Can’t Use It Yet

Gemini 4 Carbon: Google’s New AI Takes the #1 Spot, But You Can’t Use It Yet Just two weeks after Gemini 4 Argon, Google announced Gemini 4 Carbon on October 28, 2026, calling it its strongest …

#ai#google#ai-codingSource