CVE-2023-30625

rudder-server vulnerable to SQL Injection

8.8 HighPublic exploitFix available

rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the rudder role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

85.8%Up 85.6 points since Jun 17, 2023

What each source reports

CVE List Score used 8.8

rudder-server vulnerable to SQL Injection

Record: CVE-2023-30625
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

EUVDEUVD-2024-2479 8.8

Record: EUVD-2024-2479
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3jmm-f6jj-rcc3 9.3

rudder-server is vulnerable to SQL injection

Record: GHSA-3jmm-f6jj-rcc3
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

NVD 8.8

Record: CVE-2023-30625
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSV 8.8

rudder-server vulnerable to SQL Injection

Record: CVE-2023-30625
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSVGHSA-3jmm-f6jj-rcc3 9.3

rudder-server is vulnerable to SQL injection

Record: GHSA-3jmm-f6jj-rcc3
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSVGO-2023-1863 No score

rudder-server is vulnerable to SQL injection in github.com/rudderlabs/rudder-server

rudder-server is vulnerable to SQL injection in github.com/rudderlabs/rudder-server

Record: GO-2023-1863
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/rudderlabs/rudder-server` Go	before 1.3.0-rc.1	1.3.0-rc.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Rudder Server SQLI Remote Code Execution	2023-06-16
Nuclei	Rudder Server < 1.3.0-rc.1 - SQL Injection

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Metasploit, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30625 is a high vulnerability (CVSS 8.8) in Rudderlabs Rudder-server, published June 16, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 85.8%, the 99th percentile. Fixed in github.com/rudderlabs/rudder-server 1.3.0-rc.1.

References

Show 7 moreShow less