Is CVE-2026-111438 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111438 being exploited in the wild.

How severe is CVE-2026-111438?

Medium severity, with a CVSS score of 6.5, published 19 October 2026.

Which products and versions are affected?

openGauss-server 3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3.

How is CVE-2026-111438 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111438?

Check whether you run openGauss-server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111438: openGauss-server replication authentication bypass in hba.cpp

CVE-2026-111438 · Severity: medium · CVSS 6.5 · Published 2026-10-19

openGauss is an open-source database system that supports high-availability replication. The authentication validation for replication connections (HADR/SW) contained a logic flaw that allowed attackers from external networks to bypass internal network restrictions and complete authentication using weak verification rules. An attacker exploiting this could access backup and transaction log data through replication protocols without proper authorization.

Vendors: openGauss.

Quick answers

Is CVE-2026-111438 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111438 being exploited in the wild.
How severe is CVE-2026-111438?: Medium severity, with a CVSS score of 6.5, published 19 October 2026.
Which products and versions are affected?: openGauss-server 3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3.
Is there a fix for CVE-2026-111438?: Yes: fixed in 7.0.0-LTS. Until then: Restrict network access to replication ports (HA port: PostPortNumber + 1) using firewall rules or network policies to ensure that only internal nodes can initiate replication connections. Review pg_hba.conf settings to ensure replication rules do not use 'trust' authentication for remote hosts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111438 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111438?: Check whether you run openGauss-server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.0.0-LTS

Restrict network access to replication ports (HA port: PostPortNumber + 1) using firewall rules or network policies to ensure that only internal nodes can initiate replication connections. Review pg_hba.conf settings to ensure replication rules do not use 'trust' authentication for remote hosts.

Technical details

The vulnerability exists in the hba_getauthmethod() function in src/common/backend/libpq/hba.cpp, where HADR/SW replication sender connections bypass the is_node_internal_connection() check and directly call check_hba_replication(), which performs weak matching against only the replication token and lacks the complete validation present in check_hba() (including remote trust policy enforcement). Non-internal HADR/SW replication connections can therefore bypass internal connection limits and complete pg_hba policy verification to achieve authentication, then read backup and log data via replication protocol. The fix requires internal connection validation for all replication sender types and enforces normal HBA policy checks for external connections.

Affected products

openGauss openGauss-server 3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, 7.0.0-RC1, 7.0.0-RC2, 7.0.0-RC3

Timeline

2026-10-19: disclosed
2026-09-10: patched: Fix merged into 7.0.0 branch via PR #9757

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.