pgEdge Control Plane up to 0.10.1 pg_hba.conf Generation pg_hba_conf improper authentication

Summaryinfo

A vulnerability was found in pgEdge Control Plane up to 0.10.1. It has been classified as problematic. This issue affects some unknown processing of the file pg_hba.conf of the component pg_hba.conf Generation. This manipulation of the argument pg_hba_conf causes improper authentication. This vulnerability is handled as CVE-2026-125323. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in pgEdge Control Plane up to 0.10.1 and classified as problematic. Affected by this vulnerability is an unknown code block of the file pg_hba.conf of the component pg_hba.conf Generation. The manipulation of the argument pg_hba_conf with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-125323 since 11/09/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.11.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• pgEdge

Name

• Control Plane

Version

• 0.10.0
• 0.10.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion