REDHAT-BUG-2487231: High severity DuckDB DuckDB vulnerability
Repository: migration-planner Priority: High Location: pkg/duckdbparser/inventorybuilder.go:65 → pkg/duckdbparser/builder.go
Description: Users upload RVTools .xlsx exports which DuckDB ingests safely. The inventory builder then runs SELECT DISTINCT "Cluster" FROM vinfo to enumerate cluster names and feeds each returned string back into ~27 query templates via text/template - unescaped, inside single quotes. A spreadsheet cell like x' UNION SELECT readtext('/var/run/secrets/kubernetes.io/serviceaccount/token') -- becomes executable SQL on the second pass.
Security Impact:
DuckDB worker runs in-process inside planner-api pod without sandbox
DuckDB's readtext()/readblob() enable arbitrary file read on pod
Can access Kubernetes service-account token, Postgres credentials, agent-JWT signing key
Single tenant's xlsx upload escalates to full SaaS compromise
Fix Suggestion: Apply existing escapeSQLString() helper (already used for ClusterFeaturesQuery) to every string field of queryParams before template execution. Patch covers all 27 call sites in builder.go. Long-term: prefer DuckDB prepared statements over text/template. See patches/f007.patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487231?
The severity of REDHAT-BUG-2487231 is rated as high, with a score of 7.
What is the risk associated with REDHAT-BUG-2487231?
The risk associated with REDHAT-BUG-2487231 is classified as a risk level of 33.
How does REDHAT-BUG-2487231 affect DuckDB?
REDHAT-BUG-2487231 affects DuckDB by potentially allowing for enumeration of cluster names via improperly handled user-uploaded data.
What components are affected by REDHAT-BUG-2487231?
The affected components in REDHAT-BUG-2487231 include the inventory builder and the DuckDB parser.
When was REDHAT-BUG-2487231 published?
REDHAT-BUG-2487231 was published on June 9, 2026.