openGauss servers have a flaw in the replication authentication routine, where external HADR or SW replication senders bypass the internal connection check. The check_hba_replication routine performs only a weak replication flag match without applying the full pg_hba trust restrictions found in check_hba(). As a result, a non‑internal network can authenticate as a replication client and read backup and log data, exposing sensitive information without gaining code execution.

Affected versions include all releases from 3.0.x through 7.0.0-RC3, specifically 3.0.x, 3.1.x, 5.0.x, 5.1.0, 6.0.x, and the 7.0.0‑RC1, RC2, RC3 builds. The issue is fixed in the 7.0.0‑LTS release after applying pull request 9757, which enforces an internal‑connection check for replication clients.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. Attackers need the ability to initiate a HADR or SW replication connection from a non‑internal network segment; no local authentication or privileged access is required beyond establishing that connection. Once connected, the attacker can retrieve replica backups and logs, which may contain confidential data. Though code execution is not supported, the confidentiality impact is significant, especially for systems with sensitive backup information.