CVE-2026-125323
Received Received - Intake

Authentication Bypass in pgEdge Control Plane

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: GitHub, Inc.

Description
pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125323
EUVD
EUVD-2026-121705

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
pgedge control_plane 0.11.0
postgresql postgres From 0.1.0 (inc) to 0.10.1 (inc)
pgedge control_plane 0.1.0
pgedge control_plane 0.10.1
pgedge control_plane From 0.11.0 (exc)
pgedge control_plane to 0.10.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects pgEdge Control Plane versions 0.1.0 to 0.10.1. It involves hard-coded trust authentication entries in generated pg_hba.conf files for local and loopback connections. These entries override operator-supplied rules, allowing any local OS account to authenticate as any PostgreSQL role without credentials, including superuser access.

Detection Guidance

Check pg_hba.conf for hard-coded trust entries at the top of the file. For systemd, inspect the generated pg_hba.conf in the pgEdge Control Plane configuration directory. Use commands like 'cat /path/to/pg_hba.conf | head -n 6' to view the first six lines. Verify if any local OS account can authenticate without credentials by testing connections as a non-privileged user.

Impact Analysis

Under systemd, any unprivileged local account can gain full control of all databases on the host. In Docker Swarm, compromise is limited to the database container. Attackers could access, modify, or delete sensitive data without authentication.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's principle of least privilege and HIPAA's access controls. Unauthorized access to databases could lead to data breaches, non-compliance penalties, and loss of trust.

Mitigation Strategies
  • Upgrade to pgEdge Control Plane version 0.11.0 or later to remove hard-coded trust entries.
  • Restrict Unix socket permissions to limit access to the Postgres socket.
  • Review and manually adjust pg_hba.conf to enforce stricter authentication rules if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...