PgEdge Control Plane (<= 0.10.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pgedge-control-plane--0.10.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 22:16:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgpgEdge Control Plane: Improper pg_hba.conf configuration (CVE-2026-125323)https://feed.craftedsignal.io/briefs/2026-11-pgedge-hba-trust-ghsa-vq9p-w6wv-cr25/Thu, 12 Nov 2026 22:16:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pgedge-hba-trust-ghsa-vq9p-w6wv-cr25/The pgEdge Control Plane forces 'trust' authentication for all local and loopback connections in generated pg_hba.conf files, allowing local users to escalate privileges to Postgres superuser.The pgEdge Control Plane automatically generates pg_hba.conf files that contain hard-coded trust authentication entries for Unix-socket and loopback connections. Because these entries are placed at the top of the configuration file, they take precedence over any operator-defined security rules. This enables any local operating-system account with access to the database host or Postgres socket to authenticate as any database role, including the superuser, without providing credentials. This issue is identified as CVE-2026-125323.

Impact

Successful exploitation results in full control over all databases hosted on the affected instance, including the ability to read, modify, or destroy all data. On deployments using systemd, any local user can perform these actions. In containerized environments, the impact is limited to users who have already gained code execution within the container.

Recommendation

  • Upgrade pgEdge Control Plane to version v0.11.0 or later immediately. This update removes the hard-coded trust entries.
  • For operators unable to upgrade, restrict file system permissions on the Unix socket for the database (e.g., set unix_socket_permissions to 0700) to prevent unauthorized local accounts from accessing the socket path.
]]>highadvisory