openGauss Server EUVD-2026-104120

Requires the openGauss deployment to run HADR or standby/switchover (SW) streaming replication AND to have a pg_hba.conf replication entry that check_hba_replication() matches permissively (notably a 'trust' method) while being reachable from a non-internal network. The attacker must be able to open a replication-protocol connection to the database from outside the internal node network. Limiting factors: deployments without HADR/SW replication senders, or whose replication pg_hba rules do not permit remote/trust access, are not exploitable; the issue is fully remediated in 7.0.0-LTS, which forces external replication connections back through check_hba() and its remote-trust prohibition. No user interaction is required.

Overall this is a medium-severity, config-dependent access-control bypass (CWE-288) rather than a drop-everything priority. The vendor CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) signals a network-reachable issue, but several signals conflict and should be weighed. First, the vector lists PR:H (privileges required), yet the root cause is an authentication BYPASS - external HADR/SW replication connections skip is_node_internal_connection() and the remote-trust prohibition in check_hba(), so where a replication trust rule exists the attacker needs NO valid credentials; PR:H therefore understates the auth-bypass nature and I independently assess PR:N. Second, the vector claims I:H, but the description and the 'Information Disclosure' tag both indicate the outcome is READING backup and WAL/log data over the replication protocol - a confidentiality impact, not integrity; I:H appears overstated. Third, no EPSS score, SSVC decision, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by configuration - it only bites deployments that run HADR/SW streaming replication AND expose a replication pg_hba rule permissive enough (notably trust) to non-internal networks. Verify the PR and integrity metrics with openGauss, since the provided vector conflicts with the description.

An attacker positioned on a non-internal network reachable to the openGauss database port opens a HADR/SW streaming-replication connection. Because the replication sender is not required to pass is_node_internal_connection(), authentication is handled by the weaker check_hba_replication() path, which omits the remote-trust prohibition, so where replication trust is configured the attacker completes authentication without credentials and streams backup and WAL/log data. No public exploit code was provided in the input.