EnterpriseDB repmgr: OS command injection in event notifications
Summary
repmgr, a tool suite for managing PostgreSQL replication clusters, inserts node names and connection strings into event notification and failover validation commands without proper escaping, which allows OS command injection. An attacker with credentials for a non-superuser repmgr database user can write a crafted node record and run OS commands as the operating system user running repmgr or repmgrd (usually postgres) on other cluster nodes that process an event using the %a, %c or %d placeholders. Deployments that do not use these placeholders are not affected, and superuser database roles gain no new capability.
Affected
- repmgr 4.0.0 through 5.5.0
- Official CVE record: affected 4.0.0 to before 5.5.1
- Only deployments that use event_notification_command or failover_validation_command with the %a, %c or %d placeholders are affected
Fixed in
- repmgr 5.5.1
- No fixed release for the 4.x branch is known to us; treat 4.x as affected until the vendor states otherwise
Workaround
- Remove the %a, %c and %d placeholders from event_notification_command and failover_validation_command until the upgrade is complete (own recommendation, not confirmed by the vendor)
- Restrict which database roles can write to the repmgr.nodes table
Exploitation
- No evidence of exploitation in the wild found at the time of writing; the CISA KEV catalogue was not checked directly
- No public proof of concept found
- VulDB lists the entry as a 0-day with confirmed status; this describes the record, not confirmed attacks
Our recommendation
- Upgrade repmgr to 5.5.1 or later and plan a migration path for any 4.x instances
- After upgrading, remove any quotes placed around %a, %c and %d, because quoted placeholders remain open to injection
- Until the upgrade is done, remove these placeholders if they are not essential and restrict write access to repmgr.nodes
- Verify that PostgreSQL and repmgr ports are not reachable from the internet and monitor changes to repmgr.nodes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- repmgr v5.5.1 release (vendor) github.com
- EDB security advisory CVE-2026-122043 www.enterprisedb.com
- CVE record CVE-2026-122043 www.cve.org
- repmgr changelog (HISTORY) github.com
- VulDB entry 435854 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- repmgr event notifications documentation github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:27.
Original description (NVD)
repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When event_notification_command is configured, repmgr substitutes the %a (node name), %c (connection string) and %d (details) placeholders into the command and runs it through the shell. %a and %c are inserted without escaping, and %d escapes only double quotes, so shell command substitution still works inside the quoting the documentation recommends. The node name and connection string come from node records in the repmgr.nodes table. An attacker with the credentials of a non-superuser repmgr database user can write a crafted node record and run OS commands, as the operating system user that runs repmgr or repmgrd (usually postgres), on other cluster nodes that process an event using these placeholders. The %a placeholder of failover_validation_command has the same flaw. Deployments whose repmgr database user is a superuser gain no new capability, because a superuser can already run OS commands, and deployments that do not use these placeholders are not affected. The issue is fixed in repmgr 5.5.1. After upgrading, operators must remove any quotes they placed around these placeholders, because a placeholder left inside double quotes is still open to command injection.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.