Prior to November 3, 2025, users of Terraform or the Google Cloud REST API could create AlloyDB for PostgreSQL clusters with an insecure default administrative password. This flaw enabled a remote attacker who had network connectivity to the cluster to obtain full administrative privileges, compromising confidentiality, integrity, and availability of the data. The vulnerability is an instance of insecure default credentials, which is mapped to CWE‑1392.

All Google Cloud AlloyDB for PostgreSQL clusters that were provisioned via Terraform or the REST API before the November 3, 2025 patch are affected. No other clients or later cluster creations are impacted, and there are no specific version numbers beyond the patch date.

The CVSS score of 9.2 indicates critical severity. The EPSS score is not available, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Exploitation required network access to the cluster and was limited to Terraform or REST API operations; other access methods are blocked. Because all impacted instances have already been remediated, there is no immediate risk to existing deployments.