The cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors

Wiz Research discovered and responsibly disclosed multiple critical vulnerabilities in cloud providers' managed PostgreSQL offerings. By analyzing vendor-specific hardenings and modifications to PostgreSQL, researchers demonstrated practical attack chains — including privilege escalation via ALTER TABLE combined with index functions on GCP Cloud SQL, OS command execution via CREATEROLE abuses on Azure, container escapes, and cross-tenant data access — and discussed the broader industry implications for tenant isolation and coordinated remediation.