PGEDGE CONTROL PLANE · CVE-2026-125323 · Infrastructure
NO FIX YET · SEE WHAT TO DO
pgEdge Control Plane versions 0.1.0 through 0.10.1 generate PostgreSQL access files that start with trust entries for local socket and loopback connections, and those entries override operator-set rules. Under the systemd orchestrator, any unprivileged operating-system account on a database host can log in as any PostgreSQL role, including the superuser, without a password.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running pgEdge Control Plane from 0.1.0 through 0.10.1 to manage PostgreSQL. The systemd orchestrator is the most exposed, since any local OS account on a database host can gain superuser access. Under Docker Swarm the attacker must first run code inside the database container, so exposure is lower. Teams not running pgEdge Control Plane can skip this.
Not affected if docker-swarm-only, not-using-control-plane
Who cares pgedge, postgresql, self-hosted, systemd
0.10.1 or earlier.pg_hba.conf for trust entries on Unix-socket and loopback lines placed above custom rules.0.11.0.pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.