Read the docs
TI-2026-76280 Aliases CVE-2026-111438GHSA-65mg-g3fh-wfvj

Authentication bypass in openGauss-server replication connections

Priority LOW 31CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

openGauss-server versions 3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, 7.0.0-RC1, 7.0.0-RC2 and 7.0.0-RC3 are affected. The HADR/SW replication sender path skips the internal connection check, and its authentication check lacks the full pg_hba checks, such as the remote trust prohibition (CWE-288). A remote attacker with high privileges can authenticate a replication connection from a non-internal network and read backup and log data through the replication protocol.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。 此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed openGauss-server (openGauss-server): 7.0.0-LTS

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openGauss-serveropenGauss-server3.0.0-3.0.5; 3.1.0-3.1.1; 5.0.0-RC1; 5.0.0-5.0.3; 6.0.0-RC1; 6.0.0-6.0.6; 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC37.0.0-LTSPatch availableCNA
  • openGauss-server VendoropenGauss-server Affected 3.0.0-3.0.5; 3.1.0-3.1.1; 5.0.0-RC1; 5.0.0-5.0.3; 6.0.0-RC1; 6.0.0-6.0.6; 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3 Fixed in 7.0.0-LTS Patch available CNA

Remediation

Upgrade to openGauss-server 7.0.0-LTS, which requires HADR/SW replication senders to pass the internal connection check. The fix is in pull request 9757 of the openGauss-server repository on GitCode.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA openGauss-server (openGauss-server) Fixed in 7.0.0-LTS

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111438
  2. 2026-10-19 Alias added: GHSA-65mg-g3fh-wfvj
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-76229 Heap overflow in openGauss HLL unpacking from missing length check CVSS 3.1HIGH 8.1
  • TI-2026-76236 Unsafe reflection in openGauss JDBC LogFactory enables class loading CVSS 3.1HIGH 7.0
  • TI-2026-12011 openGauss存在非法内存访问导致DoS漏洞 CVSS 3.1MEDIUM 5.9
  • TI-2026-76281 Missing permission check in openGauss lets users read table file blocks CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences