Access Control Bypass in openGauss-server by OpenGauss Project

CVE-2026-111438

What is CVE-2026-111438?

The openGauss-server has a vulnerability in its handling of connection authentication in the HADR/SW replication process. The function hba_getauthmethod() fails to adequately verify if the connection is internal, allowing unauthorized external connections to bypass critical security mechanisms defined by the pg_hba configuration. This oversight permits external entities to authenticate successfully without complete validation, potentially accessing sensitive backup and log data via replication protocols. The flaw has been present since version 3.0.0, affecting several subsequent versions until it was addressed in the 7.0.0-LTS release, which enforces the required internal connection check through is_node_internal_connection() to enhance security.

References