CVE-2026-111438
Received Received - Intake

Access Control Bypass in openGauss HADR Replication

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: openGauss Community

Description
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。 此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111438
EUVD
EUVD-2026-104120

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
openGauss-server openGauss-server 3.0.0-3.0.5
openGauss-server openGauss-server 3.1.0-3.1.1
openGauss-server openGauss-server 5.0.0-RC1
openGauss-server openGauss-server 5.0.0-5.0.3
openGauss-server openGauss-server 6.0.0-RC1
openGauss-server openGauss-server 6.0.0-6.0.6
openGauss-server openGauss-server 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an access control bypass in openGauss-server's HBA (Host-Based Authentication) authentication for replication connections. It occurs in hba.cpp where HADR/SW replication senders bypass internal connection checks and weak matching in check_hba_replication() allows external connections to authenticate and read backup/log data via replication protocol.

Detection Guidance

Detecting this vulnerability requires checking if HADR/SW replication connections bypass internal authentication in openGauss. Verify if your openGauss version is affected (3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, 7.0.0-RC1/2/3). Check pg_hba.conf for replication entries that may allow unauthorized access. Review logs for external replication connections that bypass internal checks.

Impact Analysis

An attacker could exploit this to bypass authentication, connect to the database as an internal node, and access sensitive data like backups and logs through the replication protocol. This could lead to data breaches or unauthorized data access.

Compliance Impact

This vulnerability could violate compliance requirements for data protection (e.g., GDPR, HIPAA) by enabling unauthorized access to sensitive data. Organizations using affected openGauss versions may fail audits due to insufficient access controls.

Mitigation Strategies

Upgrade to openGauss-server version 7.0.0-LTS or later to apply the fix that enforces is_node_internal_connection validation for HADR/SW replication senders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111438. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart