CVE-2026-111438
MediumCVSS 6.5Summary
In openGauss-server, src/common/backend/libpq/hba.cpp contains an access control bypass in replication connection authentication. hba_getauthmethod() for HADR/SW replication senders does not require is_node_internal_connection() and calls check_hba_replication(), which only performs weak matching on the replication flag, skipping full pg_hba checks (including the remote trust prohibition). This allows external replication connections to bypass internal connection restrictions and full pg_hba policy, enabling reading of backup and log data via the replication protocol.
Risk Assessment
An attacker from an external network can bypass pg_hba policy and gain access to replication data, including backups and logs. This breaches confidentiality and integrity of data in the openGauss cluster.
Recommendation
Update openGauss-server to version 7.0.0-LTS or later, which enforces is_node_internal_connection for HADR/SW replication senders. Until then, restrict network access to replication ports.
Other vulnerabilities in openGauss-server
See all- CVE-2026-111439Medium
In openGauss-server, the built-in function pg_read_binary_file_blocks() in src/common/backend/utils/adt/genfile.cpp has a permission check flaw. The function only validates the range of startBlockNum and blockCount, then calls ReadBinaryFileBlocksFirstCall(), which does not verify the caller's SELECT privileges. Any user with ordinary database connection access can read binary blocks of table data without SELECT permission if they know the relation file path.
- CVE-2026-111441High
In openGauss-server's hll.cpp, the HllObjectUnpack() function has a length validation flaw. After parsing lenUsed and lenTotal from user-supplied packed HLL, it only checks that input length covers HLL_HEAD_SIZE + lenUsed, then allocates a buffer by lenTotal and copies via memcpy_s() by lenUsed, without validating lenTotal >= lenUsed and passing lenUsed instead of lenTotal as destination size. A regular database user can craft a malformed packed HLL (e.g., via ::hll into hll_in()) to trigger a server-side heap overflow.
Original NVD description (English source)
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。 此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。
Vulnerability data from NVD (NIST) · CISA KEV · EPSS