CVE-2026-7428: Insecure default administrative credentials in AlloyDB for PostgreSQL
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database.
Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7428?
CVE-2026-7428 is considered a high-severity vulnerability due to the risk of remote exploitation via insecure default administrative credentials.
How do I fix CVE-2026-7428?
To fix CVE-2026-7428, ensure that all administrative credentials are changed from the default to secure, unique passwords in AlloyDB for PostgreSQL deployments.
Who is affected by CVE-2026-7428?
Users of Google AlloyDB for PostgreSQL versions prior to 2025-11-03 are affected by CVE-2026-7428.
What type of vulnerability is CVE-2026-7428?
CVE-2026-7428 is an insecure default credential vulnerability that can allow unauthorized access to administrative functions.
When was CVE-2026-7428 disclosed?
CVE-2026-7428 was disclosed on November 3, 2025, relating to earlier versions of AlloyDB for PostgreSQL.