CVE-2026-125323

Name of the Vulnerable Software and Affected Versions pgEdge Control Plane versions 0.1.0 through 0.10.1

Description The application generates pg hba.conf files containing hard-coded trust entries for Unix-socket and loopback connections. Since PostgreSQL processes this file sequentially from top to bottom, these entries override custom rules defined in the pg hba conf field. When using the systemd orchestrator, any unprivileged operating-system account on a database host can authenticate as any PostgreSQL role, including the superuser, without providing credentials, granting full control over the databases on that host. In Docker Swarm environments, this requires code execution within the database container to access the local socket or loopback interface. Connections from the host to the published PostgreSQL port are not affected as they do not originate from 127.0.0.1 or ::1.

Recommendations Update pgEdge Control Plane to version 0.11.0.