📊 HiddenMerit Daily · Issue 63

Focus on Database Frontiers, Practical Insights for DBAs July 28, 2026 ｜ 5 Selected Global Breaking News

01｜CAICT Report: China Database Market to Reach RMB 98 Billion by 2028, AI‑Native Reshaping Industry Landscape

On July 9, at the 2026 Trustworthy Database Development Conference, CAICT officially released the “Database Development Research Report (2026),” comprehensively revealing the latest landscape and evolution directions of the global and Chinese database markets.

Key Data:

Global Market: The global database market reached $131.6 billion in 2025 (approximately RMB 894.09 billion).
Chinese Market: The Chinese database market reached $9.49 billion in 2025 (approximately RMB 67.796 billion), accounting for 7.2% of the global market. By 2028, the total Chinese database market is expected to reach RMB 97.974 billion, with a compound annual growth rate of 13.06% .
Cloud Share: The public cloud database market reached RMB 44.265 billion in 2025, up 15.2% year‑on‑year. The public cloud share is expected to expand from 65.3% to 66.2% in 2026.

Industry Landscape: As of June 2026, there are 394 database product providers globally, with China (150) and the US (94) leading in vendor count. After rapid growth from 2022 to 2024, the number of domestic database products significantly declined in 2025, stabilising and rebounding to 182 products in 2026, with a clear head‑concentration effect.

Technology Trends: The report notes that database technology is accelerating its evolution toward the AI‑native direction, and databases are upgrading from “underlying support systems” to “core engines enabling intelligent decision‑making and business innovation.” Data‑intensive industries such as finance, telecommunications, and energy have already adopted a pragmatic approach of tiered deployment and differentiated selection. Domestic databases are moving from peripheral replacement into the core system deep‑water zone.

DBA Perspective: The forecast of a nearly RMB 98 billion market by 2028 provides macro‑level confidence for DBAs’ career development. The AI‑native direction and the “head‑concentration” signal mean that DBA skills must upgrade from “basic domestic database operations” to “multi‑modal data processing and mixed‑load tuning under AI‑native architectures,” while focusing on the technology stacks of leading vendors.

02｜Dajia Insurance Over RMB 12 Million Database Contracts Land: OceanBase and CETC Kingware Both Win Bids

This week, the insurance industry saw successive large‑scale domestic database procurement orders. Dajia Insurance Group’s OceanBase database expansion project (three‑year framework) was won by Digital China for RMB 6.3 million, to support new system adaptation and business expansion needs. Simultaneously, CETC Kingware won Dajia Insurance’s database licence procurement project for approximately RMB 6.22 million, covering 81 licences for group‑side and 3 for asset management‑side.

Previously, Issue 46 reported that Dajia Insurance had already procured 12 TiDB nodes for nearly RMB 1 million; Issue 28 reported that PICC Technology procured GaussDB, OceanBase, and Dameng in bulk. Now, with OceanBase and CETC Kingware both winning major orders from Dajia Insurance, the trend of leading insurers procuring multiple domestic database brands in bulk is now well established.

DBA Perspective: DBAs’ skill sets must extend beyond “a single database” to “multi‑brand database operations capabilities.” CETC Kingware’s KingbaseES V9 has been selected for the Xinchuang database list and has successfully supported tens of millions of concurrent transaction scenarios in key industries such as finance and telecommunications. Its “centralised + distributed” dual‑architecture approach provides flexible options for enterprises at different stages of development.

03｜DbGate Exposes CVSS 10.0 Remote Code Execution Vulnerability – Default Unauthenticated Access Allows Full Host Takeover

On July 23, security firm IONIX disclosed a critical vulnerability (CVE-2026-47668, CVSS 10.0) in the DbGate database management tool. DbGate is a cross‑platform web‑based database management tool that supports connecting to MySQL, PostgreSQL, MongoDB, SQL Server, and various other databases.

Vulnerability Details: The vulnerability resides in DbGate’s JSON script runner endpoint (/runners/start), where the assignCore() method directly concatenates user‑controlled parameters into dynamically generated JavaScript code, executing it via eval. Authentication is disabled by default in a standard DbGate installation – meaning any unauthenticated attacker with network access to the endpoint can trigger the vulnerability, gain operating system privileges of the Node.js process, and achieve remote code execution and full host takeover. Affects all versions up to 7.1.8. Fixed in version 7.1.9. Public PoC has been released.

DBA Perspective: CVSS 10.0 is the highest risk rating. As a multi‑database management tool, DbGate is often deployed on internal networks and sometimes even exposed to the public internet. The default unauthenticated design means that once the tool is exposed to the public internet, it effectively hands database management privileges directly to attackers. DBAs should immediately check DbGate versions, upgrade to 7.1.9, and mandatorily enable authentication while avoiding exposing DbGate to the public internet.

04｜Apache Doris Critical Vulnerability CVE-2026-58319 (CVSS 9.1): Unauthenticated Attackers Can Access Admin API

Apache Doris, a real‑time analytical database, has been found to have a critical authentication bypass vulnerability (CVE-2026-58319, CVSS 9.1). Its frontend HTTP REST management API lacks authentication, allowing unauthenticated attackers with network access to execute administrative operations, threatening cluster stability and data availability.

Vulnerability Details: The vulnerability stems from improper authentication checks in the Apache Doris frontend (FE) HTTP service. Certain administrative REST endpoints do not verify the caller’s identity. Attackers with network access to the FE HTTP port (default 8030) can send unauthorised administrative requests, affecting cluster integrity and potentially causing denial of service or cluster instability. Affects Apache Doris versions 2.1.0 through 3.1.0‑pre. Fixed in version 3.1.0.

DBA Perspective: The CVSS 9.1 rating means this vulnerability has an extremely low exploitation barrier. As a widely deployed real‑time analytical database and lakehouse acceleration engine, Apache Doris’s management API being accessible without authentication is like leaving the front door unlocked. DBAs using Doris should immediately check versions and upgrade to 3.1.0 or higher, or implement strict network access controls on the FE HTTP port before upgrading.

05｜Transwarp Contributes to CAICT Report and Selected for Multiple Industry Landscape Categories, GPU‑Native Database Stands Out

At the 2026 Trustworthy Database Development Conference, Transwarp contributed to the “Database Development Research Report (2026)” and was selected for multiple categories in the “China Database Industry Landscape (2026),” covering transaction databases, analytical databases, time‑series databases, graph databases, search databases, and multi‑model databases.

[quads id="805"]

GPU‑Native Database Direction: The report notes that database architecture is evolving from CPU‑centric general‑purpose computing to high‑parallelism computing architectures that leverage GPUs as key acceleration engines. Transwarp’s GPU‑Native Cognitive Database restructures the database computing architecture around the GPU, integrating databases, knowledge bases, and memory systems into a unified foundation. It combines SQL analytics, knowledge retrieval, machine learning acceleration, memory and context management on a single foundation, supporting high‑performance online analytics, RAG multi‑model hybrid retrieval, machine learning compute, and cross‑session memory scenarios.

Security and Reliability Certification: Transwarp’s distributed database ArgoDB V6 has passed the “Security and Reliability Assessment” certification jointly issued by the China Information Security Evaluation Center and the National Secrecy Science and Technology Evaluation Center, fully adapting to domestic chips such as Phytium, Kunpeng, Hygon, and Loongson, as well as domestic operating systems such as Kylin and UnionTech UOS. ArgoDB has been deployed in finance, public sector, energy, healthcare, transportation, manufacturing, and other industries, successfully replacing Oracle, Teradata, SAP HANA, and IBM DB2.

DBA Perspective: A GPU‑native database means the dimensions of DBA tuning will expand from CPU cores, memory allocation, and disk I/O to GPU video memory management, parallel stream scheduling, and data residency strategies. Transwarp’s selection for multiple industry landscape categories also validates the technical maturity of domestic databases in analytical, time‑series, graph, and other multi‑modal directions. ArgoDB’s successful replacement of Oracle and Teradata in the financial sector provides a reference benchmark for DBAs in Xinchuang selection.

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is CVSS 10.0?

CVSS 10.0 is the highest risk rating in the Common Vulnerability Scoring System, indicating that the vulnerability possesses all of the following characteristics:

Attack Vector (AV:N): Remotely exploitable over the network.
Attack Complexity (AC:L): Low exploitation difficulty, requiring no special conditions.
Privileges Required (PR:N): No authentication required.
User Interaction (UI:N): No action required from the target user.
Scope (S:C): The vulnerability’s impact is not limited to the affected component itself; it can affect associated systems.
Confidentiality/Integrity/Availability Impact (C:H/I:H/A:H): Complete loss of all three.

DbGate CVE-2026-47668 meets all the above conditions – CVSS 10.0 means that an attacker can fully compromise the target host with just network access, without any credentials or any user interaction.

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.