Critical · published January 8, 2026
🔥 A Backup Administrator can unleash chaos by sending a single malicious password parameter, executing code as the powerful postgres user! 🚨 Think of it as a hotel where the staff can access any room just by saying the right code. If that code isn’t checked, any staff member could stroll in, change things around, or even throw a wild party in someone else's suite! An attacker with this access could execute commands at will, compromising sensitive data and potentially taking over the entire database system. This could lead to catastrophic data breaches, loss of integrity, and a major headache for everyone involved. Imagine losing all your valuables because someone had the wrong passcode!
Think of it as a hotel where the staff can access any room just by saying the right code. If that code isn’t checked, any staff member could stroll in, change things around, or even throw a wild party in someone else's suite! This vulnerability allows a Backup Administrator to perform remote code execution by injecting a malicious password parameter, which gets executed with the privileges of the postgres user. Essentially, it’s an unchecked input that gives too much power to someone who shouldn't have it.
An attacker with this access could execute commands at will, compromising sensitive data and potentially taking over the entire database system. This could lead to catastrophic data breaches, loss of integrity, and a major headache for everyone involved. Imagine losing all your valuables because someone had the wrong passcode! Patch your systems immediately to the latest version and restrict Backup Administrator privileges to ensure only trusted individuals have access. Review your logging and monitoring practices to spot any suspicious activity related to the postgres user. Don’t wait—secure your databases now! You've got this! Fixing this vulnerability will help you safeguard your data and maintain your hero status! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| veeam/veeam_backup_\&_replication | ≥ 13.0.0.4967, < 13.0.1.1071 | 13.0.1.1071 |