CVE-2026-111438 Details
Description
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。 此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。
A vulnerability allowing access control bypass in replication authentication has been identified in openGauss Server versions 3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, and the release candidates 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3. The issue arises in the file 'src/common/backend/libpq/hba.cpp', where the 'hba_getauthmethod()' function fails to properly validate HADR/SW replication sender connections. Instead of requiring an internal connection check, it directly calls 'check_hba_replication()', which only performs a weak match based on the replication token. This omission allows HADR/SW replication connections from non-internal networks to bypass internal connection restrictions and the full pg_hba policy, enabling authentication and the unauthorized reading of backup and log data through the replication protocol.
Users can upgrade to openGauss Server version 7.0.0-LTS, where this vulnerability has been fixed. Instructions for upgrading can be found in the openGauss documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitcode.com/opengauss/openGauss-server/pull/9757 | openGauss Community | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | openGauss Community |
Affected Products
| Product | Versions |
|---|---|
| openGauss-server | ~3.0 ~3.1 ~5.0 5.1.0 (semver) ~6.0 7.0.0-RC1 (semver) 7.0.0-RC2 (semver) 7.0.0-RC3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | openGauss Community |