CVE-2023-30625: RudderStack rudder-server SQL injection leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with low privileges, no user interaction, and a path to RCE, plus very high EPSS and public exploit references, make this a high-priority fix despite no KEV listing.

What it is

rudder-server before 1.3.0-rc.1 is vulnerable to SQL injection. Because the Postgres 'rudder' role has superuser permissions by default, the injection can escalate to remote code execution. This matters because a data pipeline component with database superuser rights turns a query flaw into full host compromise.

Impact

An attacker with a low-privileged account can inject SQL, gain control of the Postgres instance, and execute code on the underlying host. This exposes all data in the CDP database and the server itself.

Attack surface

The flaw is network reachable (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). An attacker needs a valid low-privileged account on the rudder-server to reach the vulnerable query path.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.858, 99.7th percentile) and a GitHub Security Lab advisory tagged Exploit plus a Packet Storm write-up exist, indicating public exploit material. No ransomware usage is documented.

What to do

• Upgrade rudder-server to 1.3.0-rc.1 or later, applying the referenced patch commits and PRs.
• Remove superuser privileges from the Postgres 'rudder' role and grant only the minimum required permissions.
• Restrict network access to the rudder-server and its Postgres instance to trusted hosts only.
• Audit and rotate credentials for any low-privileged accounts that can reach the vulnerable query path.
• Monitor Postgres logs for anomalous or injected SQL from the rudder role.

Detection

• Review Postgres logs for SQL statements containing injection patterns or unexpected stacked queries from the rudder role.
• Alert on new processes or command execution spawned by the Postgres service account.
• Monitor for unusual outbound connections from the rudder-server or database host.
• Track authentication and query activity from low-privileged rudder accounts for deviations from baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.