CVE Intelligence
Analysis AI-assisted

CVE-2026-7428: Insecure default administrative password in Google Cloud AlloyDB for PostgreSQL

Google Cloud AlloyDB for PostgreSQL clusters created through Terraform or the REST API before 2025-11-03 could receive an insecure default administrative password. The record lists a CVSS 4.0 score of 9.2 (critical), and no confirmed exploitation appears in the sources consulted. Operators should verify and rotate administrative credentials on any affected clusters.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7428 concerns an insecure default administrative password that could be set when AlloyDB for PostgreSQL clusters were created with Terraform or the REST API. According to the record, the issue applies to versions prior to 2025-11-03.

Impact

  • The record states that a remote attacker with network access to the cluster could gain full administrative access to the database.
  • The CVSS 4.0 vector rates the impact to the vulnerable system as high for confidentiality, integrity and availability, and the SSVC technical impact is total.
  • According to the record, exploitation was limited to clients using Terraform or the REST API.

Affected products and versions

  • Google Cloud AlloyDB for PostgreSQL, listed as versions before 2025-11-03.
  • The record lists no fixed versions. Whether a fixed build exists, and its identifier, is unknown from the available data.

Exploitation status

The CVE is not listed in the CISA KEV catalog in this record. No confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is none and automatable is no. EPSS gives a probability of 0.00406 with a percentile of 0.32976.

Remediation and mitigation

  • Review the vendor release notes linked in the references and confirm whether your AlloyDB environment reflects the relevant changes.
  • Identify clusters created through Terraform or the REST API before 2025-11-03 and verify that administrative passwords are not default or predictable values.
  • Rotate administrative credentials to unique, strong values held in a secrets manager, and remove any hardcoded passwords from infrastructure-as-code templates.
  • Limit network access to cluster endpoints to trusted sources only.

Detection guidance

  • Review database and cloud audit logs for administrative logins from unexpected sources or at unexpected times.
  • Check infrastructure-as-code repositories and deployment history for cluster creation during the affected period.

Limitations of the available information

  • The record does not state the exact fix date or detailed remediation steps.
  • No fixed version string is provided in the record.
  • The release notes reference was not verified for its content in this analysis.
  • Whether a default password remains set on any given cluster cannot be determined from the record.

Frequently asked questions

Is CVE-2026-7428 known to be actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which AlloyDB clusters may be affected?

According to the record, clusters created through Terraform or the REST API before 2025-11-03 could have been given an insecure default administrative password.

What should administrators do first?

Identify affected clusters, verify administrative credentials, rotate them to unique strong values, limit network access, and review the vendor release notes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.