Veille CVE

Vendredi 31 juillet 2026

2 CVE sur 6

Critique 3 Élevée 1 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « PostgreSQL » ✕
  1. CVE-2026-68563 5.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 9

    A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

  2. CVE-2026-62845 4.7 Moyenne

    clastix kamaji

    Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.