Vulnerability · Published May 12, 2026 · Assigned by GoogleCloud
CVE-2026-7428Insecure default administrative credentials in AlloyDB for PostgreSQL
Critical 9.2
In plain English
A critical-severity security flaw in AlloyDB for PostgreSQL from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | AlloyDB for PostgreSQL | 0 – before 2025-11-03 |
Weakness: CWE-1392 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber