Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Exasol 7.1.30 docker-db default SYS credential enables command execution

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Researchers disclosed command execution in Exasol Database 7.1.30 docker-db via a default SYS credential; no fix or CVE is named.

0day Rubbish Research Team disclosed a flaw in Exasol Database 7.1.30, examined in its docker-db single-container form. A shipped default SYS credential can reach PYTHON3 UDF command execution; commands run as uid=500(exadefusr) and output is returned in-band. The disclosure rates the issue 8.8 and limits the finding to that docker-db form. Clients use a binary SQL protocol on port 8563, which the snippet says uses a self-signed TLS certificate. Exploit-DB lists a remote command-execution exploit for 7.1.30 but does not say whether authentication is required. Neither report names a CVE, a patched release, or confirmed attacks.

Key facts
  • Affected product version named is Exasol Database 7.1.30.
  • Default SYS credential reaches PYTHON3 UDF os.popen execution.
  • Commands run as uid=500(exadefusr); output returned in-band.
  • Disclosure title rates the issue 8.8; finding limited to docker-db.
  • No CVE, patch, or confirmed attacks are stated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Researchers disclose Exasol 7.1.30 docker-db command execution · Full Disclosure
  2. Oct 21, 2026Exploit-DB lists remote command-execution exploit for 7.1.30 · Exploit-DB

What each outlet adds

beyond the shared facts
  • Full DisclosureDefault SYS credential, PYTHON3 UDF path, docker-db scope, and 8.8 rating
  • Exploit-DBPublic remote exploit listing; no auth, CVE, or fix details
Vendors
ParasoftExasol AGExasol
Products
Continuous Testing PlatformExasol Database
Organizations
0day Rubbish Research Team

Coverage

oldest first · one row per article · UTC
  1. · 10d ago Full DisclosureFirst report

    Exasol Database 7.1.30 docker-db default SYS credential enables command execution

    The docker-db image ships a default SYS credential that reaches os.popen through a PYTHON3 UDF.

  2. · 10d ago Full Disclosure

    Parasoft CTP 10.7.5-SNAPSHOT anonymous deserialization leads to command execution

    Researchers say an anonymous database-restore deserialization in the em web app can run commands as uid=1000.