Live › vulnerability › CVE-2026-111438
Go to dashboardopenGauss HADR and SW replication senders skip the internal-connection check and the full pg_hba policy, so replication connections from non-internal networks can authenticate. An attacker who authenticates this way can read backup and log data through the replication protocol.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running affected openGauss versions with HADR or SW replication enabled are exposed, especially where replication senders accept connections from outside the internal network. Deployments on or later, or without HADR or SW replication, can skip this.
7.0.0-LTSNo product ranges from the sources yet.
3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, or 7.0.0-RC1 to 7.0.0-RC3.pg_hba.conf for replication entries that accept non-internal addresses.7.0.0-LTS.pg_hba.conf to internal addresses until the upgrade is done.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。
此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。
This page as .md · .json · in your agent: get_signal("CVE-2026-111438")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.