CVE-2026-7428

Full vulnerability record from the local CVENow database.

Description

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.

Severity

CRITICAL

CVSS score

9.2 (v4.0)

Vulnerability status

Awaiting Analysis

Source identifier

f45cbf4e-4146-4068-b7e1-655ffc2c548c

Published

2026-05-12 10:16:48.490000

Last modified

2026-10-26 18:10:00.173000

View original CVE JSON

{
  "id": "CVE-2026-7428",
  "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
  "published": "2026-05-12T10:16:48.490",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [
    {
      "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
      "tags": [
        "exclusively-hosted-service"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database.\n\n\n\n\nExploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it."
    },
    {
      "lang": "es",
      "value": "Antes del 03-11-2025, usuarios bienintencionados de Terraform o la API REST para Google Cloud AlloyDB para PostgreSQL podrían haber creado clústeres con una contraseña predeterminada insegura que podría haber sido explotada por un atacante remoto para obtener acceso administrativo completo a la base de datos.\n\nLa explotación requería acceso a la red al clúster de AlloyDB y se limitaba a Terraform o la API REST, ya que otros clientes lo bloqueaban."
    }
  ],
  "affected": [
    {
      "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
      "affectedData": [
        {
          "vendor": "Google Cloud",
          "product": "AlloyDB for PostgreSQL",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2025-11-03",
              "versionType": "date",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
          "baseScore": 9.2,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "AMBER"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T12:23:39.985567Z",
          "id": "CVE-2026-7428",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1392"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.cloud.google.com/alloydb/docs/release-notes#April_28_2026",
      "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"
    }
  ]
}