High, CVSS 7.8GoAmendedPublished
pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
CVE-2026-125323 · GHSA-vq9p-w6wv-cr25
- Affected
- Go github.com/pgEdge/control-plane < 0.11.0
- Fixed in
- 0.11.0· Vendor fix available
- Issue
- Every `pg_hba.conf` generated by the pgEdge Control Plane begins with a hard-coded block of `trust` entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential. Details The generated file opens with the following six entries: ``` local all all trust host all all 127.0.0.1/32 trust host all all ::1/128 trust local replication all trust host replication all 127.0.0.1/32 trust host replication all ::1/128 trust ``` Postgres evaluates `pg_hba.conf` top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule below them — including entries supplied by an operator through the `pg_hba_conf` field of a database node specification, which are appended lower in the file and are therefore never reached for…
Recommended action: Upgrade to 0.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.