TiDB leak report: root-level org takeover bug left unfixed for 4 years, creds in Jira
arpit_bhayani · x · 2026-10-21
Citing four verbatim statements from a leaked TiDB report, the author details severe security failures at PingCAP: researchers replicated the control-plane database using credentials committed to TiDB's own repos (GCP service-account keys, Azure service principal); an admin account where impersonation bypasses org checks; a 2022-dated internal ticket admitting any customer org member — even billing-only — could root-takeover every cluster, unfixed through September 2026; and engineers pasting customers' production credentials into Jira tickets.
More from Infra
- Next Xbox Reportedly to Cost $1,200-$1,800 in 2028 as AI Devours Memory Supply — aakashgupta · 2026-10-21
- Investor: market underestimates compute demand 1,000x, heading terawatt-scale — inductionheads · 2026-10-21
- FireTrident lets 80 coding agents share one repo, clearing Hono's 958 violations in 62s — dinasaur_404 · 2026-10-21
- xAI said to lean on ACC/AEC and copper as Chinese pluggables stay off-limits — jwt0625 · 2026-10-21
- Packed a16z SF infra event features fal, ElevenLabs, BFL and Krea engineers — venturetwins · 2026-10-21
- Baseten ships DeepSeek v4.1 Flash, Reflection Beam 1.0, Nemotron Super 3.5 VL day-zero with claimed top benchmarks — baseten · 2026-10-21