Replication Integrity Bypass via Lua `redis.set_repl(REPL_NONE)` Enables Silent Data Corruption and Persistent Backdoor Functions on Aiven Managed Valkey
Valkey replication stealth path bypasses listpack validation.
Read the writeup →Databases & Data Services
14 writeupsAiven Internal System Account Password Hashes Exposed to Customer Users via mysql.user SELECT on Aiven Managed MySQL
MySQL binlog ACL bypass surfaces replication credentials.
Read the writeup →Report: aiven_gatekeeper Bypass via Implicitly Castable Argument Types
aiven_gatekeeper extension bypassed via implicit-cast-driven shadow functions.
Report: Unqualified `parse_ident()` in SECURITY DEFINER Function (CVE-2025-31480 Variant)
parse_ident without schema qualification inside SECDEF: variant of CVE-2025-31480 territory.
Report: Autovacuum Arbitrary Code Execution via Expression Index Shadow Functions
Autovacuum executes attacker-defined function under the SECURITY_RESTRICTED bypass path.
Read the writeup →ASLR Bypass via Lua Function Pointer Leak in Aiven Managed Valkey
ASLR leak through replication metadata.
Read the writeup →Report: Superuser Database Connection via SECURITY DEFINER dblink Chain
SECURITY DEFINER + dblink loopback chain reaches an unrestricted superuser session.
Read the writeup →Report: Privilege Boundary Violation via Subscription Ownership Escalation
Postgres CREATE SUBSCRIPTION executes under session_user=postgres, escalating sandboxed user to superuser context.
Authenticated DoS: Karapace REST Proxy Crash via GZIP Compression Bomb in Kafka Messages
Karapace REST proxy accepts gzip-compressed messages and decompresses without bounds.
Read the writeup →Authenticated DoS: Dragonfly Server Crash via Crafted Stream RESTORE Payload
Unbounded allocation in Dragonfly's stream RESTORE path.
Read the writeup →Stack Overflow in JSONMergePatch Crashes Aiven Managed ClickHouse via Single SELECT Query
Single SELECT JSONMergePatch(...) SIGSEGVs the managed instance. Crash payload is storable in shared tables.
Sql Query Optimizer Idor
Cross-project access to SQL optimizer artifacts via predictable object IDs.
Read the writeup →Project Name Enumeration
403 vs 404 oracle on /v1/project/<name> enumerates the entire managed-services customer base.
Email Enumeration Timing
/v1/userauth timing differential distinguishes registered vs unregistered emails.