https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 19:11:35 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-125323 <p>pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host&#39;s databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.</p> <p>pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host&#39;s databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-125323 https://db.gcve.eu/vuln/ghsa-vq9p-w6wv-cr25 <p><strong>Affected:</strong> Go: github.com/pgEdge/control-plane</p> <p>### Summary</p> <p>Every `pg_hba.conf` generated by the pgEdge Control Plane begins with a hard-coded block of `trust` entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential.</p> <p>### Details</p> <p>The generated file opens with the following six entries:</p> <p>``` local all all trust host all all 127.0.0.1/32 trust host all all ::1/128 trust local replication all trust host replication all 127.0.0.1/32 trust host replication all ::1/128 trust ```</p> <p>Postgres evaluates `pg_hba.conf` top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule below them — including entries supplied by an operator through the `pg_hba_conf` field of a database node specification, which are appended lower in the file and are therefore never reached for local or loopback connections.</p> <p>Both supported orchestrators emit these entries, but exposure differs by deployment model:</p> <p>* **systemd** — the database runs on a shared multi-user host. Any local account on that host can connect as the Postgres superuser. This is the higher-severity case and the one the CVSS score below reflects. * **Docker Swarm** — the Unix socket and the…</p> <p><strong>Affected:</strong> Go: github.com/pgEdge/control-plane</p> <p>### Summary</p> <p>Every `pg_hba.conf` generated by the pgEdge Control Plane begins with a hard-coded block of `trust` entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential.</p> <p>### Details</p> <p>The generated file opens with the following six entries:</p> <p>``` local all all trust host all all 127.0.0.1/32 trust host all all ::1/128 trust local replication all trust host replication all 127.0.0.1/32 trust host replication all ::1/128 trust ```</p> <p>Postgres evaluates `pg_hba.conf` top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule below them — including entries supplied by an operator through the `pg_hba_conf` field of a database node specification, which are appended lower in the file and are therefore never reached for local or loopback connections.</p> <p>Both supported orchestrators emit these entries, but exposure differs by deployment model:</p> <p>* **systemd** — the database runs on a shared multi-user host. Any local account on that host can connect as the Postgres superuser. This is the higher-severity case and the one the CVSS score below reflects. * **Docker Swarm** — the Unix socket and the…</p> https://db.gcve.eu/vuln/ghsa-vq9p-w6wv-cr25