Vulnerability in pgEdge Control Plane Affects PostgreSQL Database Management
CVE-2026-125323

7.8HIGH

Key Information:

Vendor

Pgedge

Status
Control-plane
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125323?

The pgEdge Control Plane, used for managing Postgres databases across hosts, has a significant vulnerability where hard-coded trust entries in generated pg_hba.conf files can allow unprivileged operating-system accounts on a host to authenticate as any PostgreSQL role without credentials. This flaw compromises the security of the host's databases, particularly when using systemd orchestrators, effectively granting full control to unauthorized users. While under Docker Swarm, a deeper code execution is needed to exploit the vulnerability, the risk remains critical for environments where the PostgreSQL port is exposed. This issue has been addressed in version 0.11.0.

Affected Version(s)

control-plane < 0.11.0

References

https://github.com/pgEdge/control-plane/security/advisori...
x_refsource_CONFIRM
https://github.com/pgEdge/control-plane/pull/470
x_refsource_MISC
https://github.com/pgEdge/control-plane/commit/88659f7388...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.