Vulnerability-Lookup

CVE-2026-125323 (GCVE-0-2026-125323)

Vulnerability from cvelistv5 – Published: 2026-11-10 17:52 – Updated: 2026-11-12 18:02

Title

pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections

Summary

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 16:30 UTC

CWE

CWE-306 - Missing Authentication for Critical Functionality
CWE-1188 - Initialization of a Resource with an Insecure Default

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7861 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/pgEdge/control-plane/security/…	x_refsource_CONFIRM
https://github.com/pgEdge/control-plane/pull/470	x_refsource_MISC
https://github.com/pgEdge/control-plane/commit/88…	x_refsource_MISC
https://github.com/pgEdge/control-plane/blob/main…	x_refsource_MISC
https://github.com/pgEdge/control-plane/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
pgEdge	control-plane	Affected: < 0.11.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:30:56.164483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T18:02:47.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "control-plane",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host\u0027s databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Functionality",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Initialization of a Resource with an Insecure Default",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:52:28.455Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"
        },
        {
          "name": "https://github.com/pgEdge/control-plane/pull/470",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/control-plane/pull/470"
        },
        {
          "name": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"
        },
        {
          "name": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"
        },
        {
          "name": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vq9p-w6wv-cr25",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125323",
    "datePublished": "2026-11-10T17:52:28.455Z",
    "dateReserved": "2026-11-09T21:22:55.597Z",
    "dateUpdated": "2026-11-12T18:02:47.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-125323",
      "date": "2026-11-13",
      "epss": "0.00121",
      "percentile": "0.01962"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "control-plane",
                "vendor": "pgEdge",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.11.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host\u0027s databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0."
          }
        ],
        "id": "CVE-2026-125323",
        "lastModified": "2026-11-12T22:18:51.470",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-125323",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:30:56.164483Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-10T18:17:33.703",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pgEdge/control-plane/pull/470"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-306"
              },
              {
                "lang": "en",
                "value": "CWE-1188"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-125323

Vulnerability from fkie_nvd - Published: 2026-11-10 18:17 - Updated: 2026-11-12 22:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md
	security-advisories@github.com	https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7
	security-advisories@github.com	https://github.com/pgEdge/control-plane/pull/470
	security-advisories@github.com	https://github.com/pgEdge/control-plane/releases/tag/v0.11.0
	security-advisories@github.com	https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "control-plane",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host\u0027s databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0."
    }
  ],
  "id": "CVE-2026-125323",
  "lastModified": "2026-11-12T22:18:51.470",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-125323",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-11-12T16:30:56.164483Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-11-10T18:17:33.703",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pgEdge/control-plane/pull/470"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VQ9P-W6WV-CR25

Vulnerability from github – Published: 2026-11-12 20:46 – Updated: 2026-11-12 20:46

Summary

pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections

Details

Summary

Every pg_hba.conf generated by the pgEdge Control Plane begins with a hard-coded block of trust entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential.

Details

The generated file opens with the following six entries:

local   all         all                     trust
host    all         all     127.0.0.1/32    trust
host    all         all     ::1/128         trust
local   replication all                     trust
host    replication all     127.0.0.1/32    trust
host    replication all     ::1/128         trust

Postgres evaluates pg_hba.conf top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule below them — including entries supplied by an operator through the pg_hba_conf field of a database node specification, which are appended lower in the file and are therefore never reached for local or loopback connections.

Both supported orchestrators emit these entries, but exposure differs by deployment model:

systemd — the database runs on a shared multi-user host. Any local account on that host can connect as the Postgres superuser. This is the higher-severity case and the one the CVSS score below reflects.
Docker Swarm — the Unix socket and the loopback interface belong to the Postgres container, so reaching these entries requires code execution inside that container. Publishing the Postgres port to the host does not change this: such connections are not seen by Postgres as originating from 127.0.0.1 or ::1, so they do not match the entries above. The practical exposure is correspondingly narrower.

An operator who verifies their own deployment can confirm the issue by inspecting the generated pg_hba.conf on a database node for the entries above.

Impact

An unprivileged local operating-system account on an affected database host obtains full control of every Postgres database on that host: read of all data, modification or destruction of all data, and any action available to a Postgres superuser. Under the systemd orchestrator this converts any local account into a database superuser with no additional prerequisites.

Affected versions

pgEdge Control Plane v0.1.0 through v0.10.1, inclusive.

Patches

Fixed in v0.11.0. Generated pg_hba.conf files no longer contain trust entries, and operator-supplied local authentication rules take effect. Upgrading to v0.11.0 or later is the recommended and, on v0.9.0 and later, the only complete remedy.

Workarounds

The available mitigation differs by version, and no mitigation is complete on current releases.

v0.1.0 – v0.8.1. An operator could take the authentication files out of Patroni's control entirely: copy the generated pg_hba.conf and pg_ident.conf, edit the copies, and point the hba_file and ident_file settings at them through node-level postgresql_conf. This is effective but must be repeated per instance, including for every node added afterwards.

v0.9.0 – v0.10.1. The above no longer applies. API validation rejects the hba_file and ident_file settings, and entries supplied through the pg_hba_conf specification array are appended below the hard-coded block rather than overriding it, so they do not take effect for local or loopback connections. The only partial mitigation available is to restrict the Unix socket: set unix_socket_permissions to 0700, or to 0770 with the intended accounts placed in the postgres group. This closes the socket path only. No supported configuration closes the loopback path on these versions. Operators on v0.9.0 – v0.10.1 should upgrade to v0.11.0.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.10.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pgEdge/control-plane"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-125323"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-12T20:46:03Z",
    "nvd_published_at": "2026-11-10T18:17:33Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nEvery `pg_hba.conf` generated by the pgEdge Control Plane begins with a hard-coded block of `trust` entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential.\n\n### Details\n\nThe generated file opens with the following six entries:\n\n```\nlocal   all         all                     trust\nhost    all         all     127.0.0.1/32    trust\nhost    all         all     ::1/128         trust\nlocal   replication all                     trust\nhost    replication all     127.0.0.1/32    trust\nhost    replication all     ::1/128         trust\n```\n\nPostgres evaluates `pg_hba.conf` top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule below them \u2014 including entries supplied by an operator through the `pg_hba_conf` field of a database node specification, which are appended lower in the file and are therefore never reached for local or loopback connections.\n\nBoth supported orchestrators emit these entries, but exposure differs by deployment model:\n\n* **systemd** \u2014 the database runs on a shared multi-user host. Any local account\n  on that host can connect as the Postgres superuser. This is the\n  higher-severity case and the one the CVSS score below reflects.\n* **Docker Swarm** \u2014 the Unix socket and the loopback interface belong to the\n  Postgres container, so reaching these entries requires code execution inside\n  that container. Publishing the Postgres port to the host does not change this:\n  such connections are not seen by Postgres as originating from `127.0.0.1` or\n  `::1`, so they do not match the entries above. The practical exposure is\n  correspondingly narrower.\n\nAn operator who verifies their own deployment can confirm the issue by inspecting the generated `pg_hba.conf` on a database node for the entries above.\n\n### Impact\n\nAn unprivileged local operating-system account on an affected database host obtains full control of every Postgres database on that host: read of all data, modification or destruction of all data, and any action available to a Postgres superuser. Under the systemd orchestrator this converts any local account into a database superuser with no additional prerequisites.\n\n### Affected versions\n\npgEdge Control Plane v0.1.0 through v0.10.1, inclusive.\n\n### Patches\n\nFixed in **v0.11.0**. Generated `pg_hba.conf` files no longer contain `trust` entries, and operator-supplied local authentication rules take effect. Upgrading to v0.11.0 or later is the recommended and, on v0.9.0 and later, the only complete remedy.\n\n### Workarounds\n\nThe available mitigation differs by version, and no mitigation is complete on current releases.\n\n**v0.1.0 \u2013 v0.8.1.** An operator could take the authentication files out of Patroni\u0027s control entirely: copy the generated `pg_hba.conf` and `pg_ident.conf`, edit the copies, and point the `hba_file` and `ident_file` settings at them through node-level `postgresql_conf`. This is effective but must be repeated per instance, including for every node added afterwards.\n\n**v0.9.0 \u2013 v0.10.1.** The above no longer applies. API validation rejects the `hba_file` and `ident_file` settings, and entries supplied through the `pg_hba_conf` specification array are appended below the hard-coded block rather than overriding it, so they do not take effect for local or loopback connections. The only partial mitigation available is to restrict the Unix socket: set `unix_socket_permissions` to `0700`, or to `0770` with the intended accounts placed in the `postgres` group. **This closes the socket path only. No supported configuration closes the loopback path on these versions.** Operators on v0.9.0 \u2013 v0.10.1 should upgrade to v0.11.0.",
  "id": "GHSA-vq9p-w6wv-cr25",
  "modified": "2026-11-12T20:46:03Z",
  "published": "2026-11-12T20:46:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125323"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgEdge/control-plane/pull/470"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pgEdge/control-plane"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-125323 (GCVE-0-2026-125323)

FKIE_CVE-2026-125323

GHSA-VQ9P-W6WV-CR25

Summary

Details

Impact

Affected versions

Patches

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour