{"id":"CVE-2026-122043","kind":"vulnerability","aliases":["CVE-2026-122043"],"related":[],"title":"repmgr: node names in event commands let database users run OS commands","description":"repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When event_notification_command is configured, repmgr substitutes the %a (node name), %c (connection string) and %d (details) placeholders into the command and runs it through the shell. %a and %c are inserted without escaping, and %d escapes only double quotes, so shell command substitution still works inside the quoting the documentation recommends. The node name and connection string come from node records in the repmgr.nodes table. An attacker with the credentials of a non-superuser repmgr database user can write a crafted node record and run OS commands, as the operating system user that runs repmgr or repmgrd (usually postgres), on other cluster nodes that process an event using these placeholders. The %a placeholder of failover_validation_command has the same flaw. Deployments whose repmgr database user is a superuser gain no new capability, because a superuser can already run OS commands, and deployments that do not use these placeholders are not affected. The issue is fixed in repmgr 5.5.1. After upgrading, operators must remove any quotes they placed around these placeholders, because a placeholder left inside double quotes is still open to command injection.","summary":"repmgr passes node names and connection strings from its database into shell commands for event notifications without proper escaping. A non-superuser with repmgr database credentials can insert a crafted node record and run OS commands as the repmgr or postgres system user on other cluster nodes.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["postgresql","repmgr","runtime","self-hosted"],"not_affected_if":["no-event-notification-command","no-placeholders","superuser-db-user"],"how_to_check":"- Check the installed version with `repmgr --version`; versions `4.0.0` through `5.5.0` are affected.\n- Look for `event_notification_command` or `failover_validation_command` in repmgr.conf that use the %a, %c or %d placeholders.\n- Check whether the repmgr database user is a superuser; superuser deployments gain no new capability.","fix":"- Upgrade repmgr to `5.5.1`.\n- After upgrading, remove any quotes placed around these placeholders, since quoted placeholders remain open to injection.","status":"open","published_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","triaged_at":"2026-11-11T17:28:53+00:00","updated_at":"2026-11-11T17:28:53+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-11T17:28:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade repmgr to `5.5.1`.\n- After upgrading, remove any quotes placed around these placeholders, since quoted placeholders remain open to injection.","reach":"network","title":"repmgr: node names in event commands let database users run OS commands","impact":"high","summary":"repmgr passes node names and connection strings from its database into shell commands for event notifications without proper escaping. A non-superuser with repmgr database credentials can insert a crafted node record and run OS commands as the repmgr or postgres system user on other cluster nodes.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["repmgr","postgresql","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"OS commands run as the repmgr or postgres user on other nodes","analyst_note":"","how_to_check":"- Check the installed version with `repmgr --version`; versions `4.0.0` through `5.5.0` are affected.\n- Look for `event_notification_command` or `failover_validation_command` in repmgr.conf that use the %a, %c or %d placeholders.\n- Check whether the repmgr database user is a superuser; superuser deployments gain no new capability.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-event-notification-command","superuser-db-user","no-placeholders"],"who_is_affected":"Only clusters running repmgr 4.0.0 through 5.5.0 that use event_notification_command or failover_validation_command with the %a, %c or %d placeholders are exposed. The attacker needs credentials for a non-superuser repmgr database user, and deployments where that user is a superuser gain nothing new. Clusters without these placeholders can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000815,"input_tokens":4871,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122043':15A,18A '-2026':14A,17A '-78':86C '4.0.0':74C '5.5.0':76C '5.5.1':251C 'affect':78C,244C 'alreadi':230C 'around':261C 'attack':158C 'c':102C,120C 'capabl':225C 'cluster':71B,194C 'come':149C 'command':6A,12A,37B,61B,82C,93C,111C,133C,179C,209C,233C,275C 'configur':95C 'connect':30B,103C,147C 'craft':55B,173C 'credenti':51B,161C 'cve':13A,16A 'cwe':85C 'd':106C,126C 'databas':8A,34B,50B,168C,217C 'deploy':214C,235C 'detail':107C 'document':141C 'doubl':129C,269C 'escap':43B,124C,127C 'event':5A,39B,88C,91C,199C 'failov':207C 'fix':248C 'flaw':213C 'gain':222C 'host':24B 'inject':83C,276C 'insert':53B,122C 'insid':137C,268C 'issu':246C 'left':267C 'let':7A 'must':255C 'name':3A,28B,101C,145C 'new':224C 'node':2A,27B,56B,72B,100C,144C,151C,174C,195C 'non':46B,165C 'non-superus':45B,164C 'notif':40B,89C,92C 'open':273C 'oper':182C,254C 'os':11A,60B,81C,178C,232C 'pass':26B 'place':260C 'placehold':108C,202C,205C,241C,263C,266C 'postgr':66B,191C 'postgresql':19B 'process':197C 'proper':42B 'quot':130C,139C,258C,270C 'recommend':142C 'record':57B,152C,175C 'remov':256C 'repmgr':1A,20B,25B,49B,64B,73C,96C,167C,187C,216C,250C 'repmgr.nodes':155C 'repmgrd':189C 'run':10A,59B,113C,177C,186C,231C 'runtim':21B 'self':23B 'self-host':22B 'shell':36B,117C,132C 'still':135C,272C 'string':31B,104C,148C 'substitut':97C,134C 'superus':47B,166C,221C,228C 'system':67B,183C 'tabl':156C 'upgrad':253C 'use':200C,239C 'user':9A,68B,169C,184C,218C 'usual':190C 'valid':208C 'vulner':84C 'whose':215C 'without':41B,123C 'work':136C 'write':171C","nicknames":[],"mitigations":[],"who_affected":"Only clusters running repmgr 4.0.0 through 5.5.0 that use event_notification_command or failover_validation_command with the %a, %c or %d placeholders are exposed. The attacker needs credentials for a non-superuser repmgr database user, and deployments where that user is a superuser gain nothing new. Clusters without these placeholders can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","postgresql","repmgr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-122043':15A,18A '-2026':14A,17A 'command':6A,12A 'cve':13A,16A 'databas':8A 'event':5A 'let':7A 'name':3A 'node':2A 'os':11A 'repmgr':1A 'run':10A 'user':9A","search_b":"'cluster':71B 'command':37B,61B 'connect':30B 'craft':55B 'credenti':51B 'databas':34B,50B 'escap':43B 'event':39B 'host':24B 'insert':53B 'name':28B 'node':27B,56B,72B 'non':46B 'non-superus':45B 'notif':40B 'os':60B 'pass':26B 'postgr':66B 'postgresql':19B 'proper':42B 'record':57B 'repmgr':20B,25B,49B,64B 'run':59B 'runtim':21B 'self':23B 'self-host':22B 'shell':36B 'string':31B 'superus':47B 'system':67B 'user':68B 'without':41B","search_c":"'-78':86C '4.0.0':74C '5.5.0':76C '5.5.1':251C 'affect':78C,244C 'alreadi':230C 'around':261C 'attack':158C 'c':102C,120C 'capabl':225C 'cluster':194C 'come':149C 'command':82C,93C,111C,133C,179C,209C,233C,275C 'configur':95C 'connect':103C,147C 'craft':173C 'credenti':161C 'cwe':85C 'd':106C,126C 'databas':168C,217C 'deploy':214C,235C 'detail':107C 'document':141C 'doubl':129C,269C 'escap':124C,127C 'event':88C,91C,199C 'failov':207C 'fix':248C 'flaw':213C 'gain':222C 'inject':83C,276C 'insert':122C 'insid':137C,268C 'issu':246C 'left':267C 'must':255C 'name':101C,145C 'new':224C 'node':100C,144C,151C,174C,195C 'non':165C 'non-superus':164C 'notif':89C,92C 'open':273C 'oper':182C,254C 'os':81C,178C,232C 'place':260C 'placehold':108C,202C,205C,241C,263C,266C 'postgr':191C 'process':197C 'quot':130C,139C,258C,270C 'recommend':142C 'record':152C,175C 'remov':256C 'repmgr':73C,96C,167C,187C,216C,250C 'repmgr.nodes':155C 'repmgrd':189C 'run':113C,177C,186C,231C 'shell':117C,132C 'still':135C,272C 'string':104C,148C 'substitut':97C,134C 'superus':166C,221C,228C 'system':183C 'tabl':156C 'upgrad':253C 'use':200C,239C 'user':169C,184C,218C 'usual':190C 'valid':208C 'vulner':84C 'whose':215C 'without':123C 'work':136C 'write':171C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122043","severity":null,"published_at":"2026-11-11T17:17:17+00:00","modified_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","fetched_at":"2026-11-11T17:28:21+00:00","note":null}],"documents":[{"id":127304,"url":"https://github.com/EnterpriseDB/repmgr/releases/tag/v5.5.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}