{"id":"CVE-2026-111438","kind":"vulnerability","aliases":["CVE-2026-111438"],"related":[],"title":"openGauss: replication auth bypass lets outside hosts read backups and logs","description":"在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。\n\n此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。","summary":"openGauss HADR and SW replication senders skip the internal-connection check and the full pg_hba policy, so replication connections from non-internal networks can authenticate. An attacker who authenticates this way can read backup and log data through the replication protocol.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","hadr","opengauss","runtime","self-hosted"],"not_affected_if":["internal-network-only","no-hadr-replication","unaffected-version"],"how_to_check":"- Confirm the installed version is `3.0.x`, `3.1.x`, `5.0.x`, `5.1.0`, `6.0.x`, or `7.0.0-RC1` to `7.0.0-RC3`.\n- Check whether HADR or SW replication is enabled on the senders.\n- Review `pg_hba.conf` for replication entries that accept non-internal addresses.","fix":"- Upgrade openGauss to `7.0.0-LTS`.\n- Review the upstream fix at https://gitcode.com/opengauss/openGauss-server/pull/9757 if you cannot upgrade yet.\n- Restrict replication entries in `pg_hba.conf` to internal addresses until the upgrade is done.","status":"open","published_at":"2026-10-19T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:22+00:00","updated_at":"2026-10-25T03:57:22+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T03:57:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade openGauss to `7.0.0-LTS`.\n- Review the upstream fix at https://gitcode.com/opengauss/openGauss-server/pull/9757 if you cannot upgrade yet.\n- Restrict replication entries in `pg_hba.conf` to internal addresses until the upgrade is done.","reach":"network","title":"openGauss: replication auth bypass lets outside hosts read backups and logs","impact":"medium","summary":"openGauss HADR and SW replication senders skip the internal-connection check and the full pg_hba policy, so replication connections from non-internal networks can authenticate. An attacker who authenticates this way can read backup and log data through the replication protocol.","category":"runtime","nicknames":[],"who_cares":["openGauss","database","hadr","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Outside hosts read backup and log data via replication","analyst_note":"","how_to_check":"- Confirm the installed version is `3.0.x`, `3.1.x`, `5.0.x`, `5.1.0`, `6.0.x`, or `7.0.0-RC1` to `7.0.0-RC3`.\n- Check whether HADR or SW replication is enabled on the senders.\n- Review `pg_hba.conf` for replication entries that accept non-internal addresses.","needs_analyst":false,"not_affected_if":["unaffected-version","no-hadr-replication","internal-network-only"],"who_is_affected":"Systems running affected openGauss versions with HADR or SW replication enabled are exposed, especially where replication senders accept connections from outside the internal network. Deployments on `7.0.0-LTS` or later, or without HADR or SW replication, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001186,"input_tokens":3719,"output_tokens":1628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111438':14A,17A '-2026':13A,16A '/gitcode.com/opengauss/opengauss-server/pull/9757':152C '3.0':118C '3.0.0':115C '3.1':120C '5.0':122C '5.1.0':124C '6.0':125C '7.0.0':128C,130C,132C,135C 'attack':54B 'auth':3A 'authent':52B,56B 'backup':9A,61B 'bypass':4A 'check':36B,88C,91C,98C,146C 'connect':35B,45B,86C,143C 'cve':12A,15A 'data':64B 'databas':18B 'full':39B 'getauthmethod':78C 'hadr':19B,26B,112C 'hadr/sw':80C,105C,138C 'hba':41B,77C,89C,92C,99C,108C,147C 'host':7A,24B 'intern':34B,49B,85C,142C 'internal-connect':33B 'let':5A 'log':11A,63B 'lts版本修复':136C 'network':50B 'node':84C,141C 'non':48B 'non-intern':47B 'opengauss':1A,20B,25B,71C 'opengauss-serv':70C 'outsid':6A 'pg':40B,107C 'polici':42B 'protocol':68B 'rc1':129C 'rc2':131C 'rc3':133C 'read':8A,60B 'replic':2A,29B,44B,67B,90C,93C,95C 'runtim':21B 'self':23B 'self-host':22B 'sender':30B 'server':72C 'skip':31B 'src/common/backend/libpq/hba.cpp':74C 'sw':28B 'trust':101C,149C 'way':58B 'x':119C,121C,123C,126C '不要求':82C '中':75C '中的远程':100C '仅按':94C '以及':127C '使外部复制连接改走普通':145C '修复pr见https':151C '受影响版本包括':117C '因此':103C '在':69C '在处理':79C '复制发送方必须经过':139C '复制发送方时':81C '复制发送方绕过内部连接校验进入代码':113C '复制连接可绕过内部连接限制和完整':106C '复制连接认证存在访问控制绕过':76C '并触发禁止远程':148C '标记做弱匹配':96C '校验':144C '此问题随':111C '的':73C '直接调用':87C '禁止等完整校验':102C '策略':150C '策略完成认证':109C '缺少普通':97C '自':114C '该问题已在':134C '起即存在':116C '进而通过复制协议读取备份与日志数据':110C '通过要求':137C '非内部网络的':104C","nicknames":[],"mitigations":[],"who_affected":"Systems running affected openGauss versions with HADR or SW replication enabled are exposed, especially where replication senders accept connections from outside the internal network. Deployments on `7.0.0-LTS` or later, or without HADR or SW replication, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","cvss_by":"a1a479f7-907b-4ae8-a999-9148cadc9224","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111438","severity":null,"published_at":"2026-10-19T09:17:07+00:00","modified_at":"2026-10-19T20:56:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}