pgEdge Control Plane: Authentication bypass via trust entries in pg_hba.conf
Summary
pgEdge Control Plane generates PostgreSQL pg_hba.conf files with hard-coded trust entries for Unix-socket and loopback connections, and these entries take precedence over operator-supplied rules. Under the systemd orchestrator, any unprivileged operating-system account on a database host can connect to PostgreSQL as any role, including the superuser, without credentials and take full control of the databases. The attack requires a local low-privilege account; under Docker Swarm, the attacker first needs code execution inside the database container.
Affected
- pgEdge Control Plane 0.1.0 through 0.10.1 (according to the CVE description; not independently verified)
Fixed in
- Fixed in version 0.11.0 (according to the CVE description)
- Vendor advisory GHSA-vq9p-w6wv-cr25: details unknown
Workaround
- Unknown.
Exploitation
- No evidence of exploitation in the wild, no public proof of concept and no CISA KEV entry found at the time of writing.
- The NVD record is still in status Received.
Our recommendation
- Upgrade Control Plane to version 0.11.0 or later.
- Until the upgrade, check generated pg_hba.conf files on database hosts for leading trust entries.
- Restrict local operating-system accounts on systemd-managed database hosts to trusted users only.
- Verify the upgrade and monitor authentication logs for unexpected superuser logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vq9p-w6wv-cr25 github.com
- pgEdge Control Plane v0.11.0 release github.com
- pgEdge Control Plane v0.11.0 changelog github.com
- Fix commit 88659f7 github.com
- Pull request #470 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:32.
Original description (NVD)
pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.
NVD references (5)
- https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md
- https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7
- https://github.com/pgEdge/control-plane/pull/470
- https://github.com/pgEdge/control-plane/releases/tag/v0.11.0
- https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.