Which versions of Google Cloud AlloyDB are affected by CVE-2026-7428?

Google Cloud AlloyDB for PostgreSQL clusters provisioned via Terraform or REST API before November 3, 2025, contain insecure default credentials enabling remote administrative database takeover.. A patch is available.

How to fix or mitigate CVE-2026-7428?

Within 24 hours, inventory all AlloyDB clusters and verify provisioning methods and dates-prioritize those created before November 3, 2025, via Terraform or REST API. Within 7 days, apply the vendor-released patch to all affected instances and rotate all database credentials, particularly administrative accounts. Within 30 days, audit database access logs for unauthorized authentication attempts, implement network segmentation to restrict database access to authorized application tiers, and verify patch deployment across all instances.

Google Cloud AlloyDB CVE-2026-7428

Q: What is the CVSS score of CVE-2026-7428?

CVE-2026-7428 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-29438 CRITICAL

Use of Default Credentials (CWE-1392)

2026-05-12 GoogleCloud

GHSA-fmcg-2r5c-wmhp

Hashicorp Google PostgreSQL Information Disclosure Alloydb For Postgresql

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

vuln.today AI

8.1 HIGH

Remote and unauthenticated once reached (PR:N/UI:N), but AC:H reflects that the cluster must have been provisioned via Terraform/REST with the insecure default; total impact gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:30 vuln.today

Patch available

May 12, 2026 - 10:16 EUVD

CVE Published

May 12, 2026 - 09:16 nvd

UNKNOWN (no severity yet)

CVE Published

May 12, 2026 - 09:16 cve.org

CRITICAL 9.2

DescriptionCVE.org

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database.

Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.

AnalysisAI

Full administrative database takeover in Google Cloud AlloyDB for PostgreSQL affected clusters provisioned via Terraform or the REST API before 2025-11-03, where those provisioning paths applied an insecure default password. A remote attacker with network reachability to such a cluster could authenticate as a privileged account and gain complete control of the database. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%, 12th percentile), consistent with the SSVC assessment of no observed exploitation.

Technical ContextAI

AlloyDB for PostgreSQL is Google Cloud's managed, PostgreSQL-compatible database service. The root cause is CWE-1392 (Use of Default Credentials): when a cluster was created through the Terraform provider (the tag set references Hashicorp) or the Google Cloud REST API, the workflow could establish an insecure default password for a database account rather than forcing a strong, unique secret. Notably, other client paths (e.g., the Cloud Console/gcloud) blocked this insecure default, meaning the weakness was specific to the Terraform/REST provisioning surface. The single affected CPE is cpe:2.3:a:google_cloud:alloydb_for_postgresql, and the flaw is a provisioning/configuration defect in the managed service rather than a memory-safety or protocol bug.

RemediationAI

Google addressed the provisioning behavior server-side as of 2025-11-03 (Patch available per vendor advisory); no customer software upgrade is required for the fix itself, but affected clusters remain at risk until their credentials are corrected. The primary action is to identify any AlloyDB cluster created via Terraform or the REST API before 2025-11-03 and rotate the database password to a strong, unique value, removing the insecure default. As compensating controls, restrict network reachability to the cluster by enforcing private IP/VPC-only access and removing any public authorized networks so a defaulted account cannot be reached from the internet, and audit IAM/database roles for unexpected privileged access; the trade-off is that tightening authorized networks may break existing application connectivity and must be validated against dependent services. Review the Google Cloud AlloyDB release notes (https://docs.cloud.google.com/alloydb/docs/release-notes#April_28_2026) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-7428) for authoritative guidance.