Is CVE-2026-122043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122043 being exploited in the wild.

How severe is CVE-2026-122043?

Informational severity, published 11 November 2026.

Which products and versions are affected?

EnterpriseDB Repmgr 4.0.0 through 5.5.0.

How is CVE-2026-122043 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-122043?

Check whether you run EnterpriseDB Repmgr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122043: repmgr OS command injection in event notifications

CVE-2026-122043 · Severity: info · Published 2026-11-11

repmgr is a replication manager for PostgreSQL that automates failover and cluster management. Versions 4.0.0 through 5.5.0 allow non-superuser database users to inject arbitrary OS commands by crafting malicious node records; these commands execute with the privileges of the postgres system user when event notifications are processed, potentially compromising the entire database cluster.

Vendors: EnterpriseDB.

Quick answers

Is CVE-2026-122043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122043 being exploited in the wild.
How severe is CVE-2026-122043?: Informational severity, published 11 November 2026.
Which products and versions are affected?: EnterpriseDB Repmgr 4.0.0 through 5.5.0.
Is there a fix for CVE-2026-122043?: Yes: fixed in repmgr 5.5.1. Until then: After upgrading to 5.5.1, remove any quotes placed around the %a, %c, and %d placeholders in event_notification_command and failover_validation_command configurations, as placeholders inside double quotes remain vulnerable to command injection. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122043 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-122043?: Check whether you run EnterpriseDB Repmgr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: repmgr 5.5.1

After upgrading to 5.5.1, remove any quotes placed around the %a, %c, and %d placeholders in event_notification_command and failover_validation_command configurations, as placeholders inside double quotes remain vulnerable to command injection.

Technical details

OS command injection (CWE-78) in event_notification_command and failover_validation_command substitution: the %a (node name) and %c (connection string) placeholders are inserted without escaping, and %d (details) escapes only double quotes, leaving command substitution possible. An attacker with non-superuser repmgr database credentials can write a crafted node record to the repmgr.nodes table and execute arbitrary commands as the postgres OS user when cluster events trigger these notifications. The vulnerability is fixed in repmgr 5.5.1 with proper escaping.

Affected products

EnterpriseDB repmgr 4.0.0 through 5.5.0

Timeline

2026-11-11: disclosed
2026-11-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.