{"id":"CVE-2026-56870","aliases":["GO-2026-6169"],"title":"Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq","summary":"Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq","severity":"none","vendor":"lib","product":"github.com/lib/pq","ecosystem":"go","affected":["github.com/lib/pq >= 1.11.0"],"published":"2026-08-18","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6169","references":[{"url":"https://github.com/golang/vulndb/issues/6169"}],"tags":["osv","go"],"ingestedAt":"2026-08-18T19:21:39.060Z","slug":"CVE-2026-56870","body":"## Overview\n\nWhen a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost and the remote address, the driver selects the secret intended for the local database and sends it to the remote endpoint when that endpoint requests password authentication.\n\n## Affected packages\n\n- `github.com/lib/pq >= 1.11.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}