CVE-2026-125323

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.

• CWE-306
• CWE-1188

• https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md
• https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7
• https://github.com/pgEdge/control-plane/pull/470
• https://github.com/pgEdge/control-plane/releases/tag/v0.11.0
• https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12529A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-1253The Group Chat & Video Chat by AtomChat plugin for WordPress…4.3
• CVE-2026-12530Improper neutralization of argument delimiters in the instal…7.3
• CVE-2026-125320pgEdge Postgres MCP Server enables SQL queries against Postg…5.3
• CVE-2026-125321pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125322pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125325pgEdge RAG Server is an API server for retrieval-augmented g…5.9
• CVE-2026-125326pgEdge RAG Server is an API server for retrieval-augmented g…5.8
• CVE-2026-125342Uninitialized resource in GPU in Google Chrome prior to 157.…
• CVE-2026-125343Buffer overflow in Compositing in Google Chrome prior to 157…
• CVE-2026-125344Type confusion in V8 in Google Chrome prior to 157.0.8103.50…
• CVE-2026-125345Uninitialized resource in WebGL in Google Chrome prior to 15…