Skip to main content
Publication date: February 6, 2023

​
Description

The global NOSQLLOGIN privilege does not restrict SQL access as it should. This privilege is granted using GRANT SYSTEM NOSQLLOGIN TO <user> but is not properly inspected by authorization checks. The bug was introduced in .

​
Statement

This is resolved in CockroachDB by fixing the logic that inspects the NOSQLLOGIN privilege. The fix has been applied to maintenance releases of CockroachDB .

​
Mitigation

A workaround is to use the older role option syntax: ALTER ROLE <user> WITH NOSQLLOGIN. Note that unlike the global privilege, the role option does not get inherited by users who are members of the role. Users of CockroachDB through are encouraged to upgrade to or a later version.

​
Impact

The NOSQLLOGIN global privilege does not correctly restrict SQL access. SQL users who should be blocked from running SQL commands are not blocked. Questions about any technical alert can be directed to our support team.