OS Command Injection Vulnerability in repmgr by EnterpriseDB
CVE-2026-122043

6MEDIUM

Key Information:

Vendor

Enterprisedb

Status
Repmgr
Vendor
CVE Published:
11 November 2026

What is CVE-2026-122043?

The OS command injection vulnerability in repmgr allows attackers with database user credentials to execute arbitrary OS commands through crafted node records. This occurs during event notifications when specific placeholders are substituted into commands without proper escaping. Attackers can manipulate parameters such as the node name and connection string, leading to potential system compromise on affected nodes. To mitigate risks, users are advised to update to repmgr version 5.5.1 and ensure that any quotes around placeholders are removed, as unhandled quoting may still permit command injection.

Affected Version(s)

repmgr 4.0.0 < 5.5.1

References

https://www.enterprisedb.com/docs/security/advisories/cve...
https://github.com/EnterpriseDB/repmgr/releases/tag/v5.5.1

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arittro Sarkar
.