Insecure Default Password in Google Cloud AlloyDB for PostgreSQL by Google

CVE-2026-7428

What is CVE-2026-7428?

Prior to November 3, 2025, a vulnerability in Google Cloud AlloyDB for PostgreSQL allowed users to inadvertently create database clusters with an insecure default password through Terraform and the REST API. This flaw could potentially be exploited by remote attackers with network access to the AlloyDB cluster, enabling them to gain full administrative access. Other clients were unaffected as they blocked this type of access, highlighting the importance of secure configuration practices when setting up cloud resources.

References