Critical · published January 8, 2026
🚨 Backup Operators could unwittingly hand over the keys to the castle! This CVE lets them execute code as the postgres user just by sending a crafty parameter. 🔥 Think of it as a security guard handing over the master key because they received a fake delivery order — it seems harmless, but now anyone can waltz right in and take anything they want! An attacker with this access could execute any code they wish, leading to full control over the database, which can result in leaking sensitive data, altering crucial records, or even dismantling critical services. The consequences could be absolutely devastating!
Think of it as a security guard handing over the master key because they received a fake delivery order — it seems harmless, but now anyone can waltz right in and take anything they want! This vulnerability allows a Backup Operator to exploit remote code execution (RCE) by injecting malicious interval or order parameters, thereby impersonating the postgres user, which is typically a privileged account.
An attacker with this access could execute any code they wish, leading to full control over the database, which can result in leaking sensitive data, altering crucial records, or even dismantling critical services. The consequences could be absolutely devastating! To remediate, ensure that only trusted personnel are designated as Backup Operators, and apply any available patches immediately. Additionally, review your security policies to restrict parameter inputs and leverage input validation mechanisms. You've got this! By taking these steps, you can secure your environment and keep those pesky attackers at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| veeam/veeam_backup_\&_replication | ≥ 13.0.0.4967, < 13.0.1.1071 | 13.0.1.1071 |