—
GO-2026-6169
Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq
Details
When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost and the remote address, the driver selects the secret intended for the local database and sends it to the remote endpoint when that endpoint requests password authentication.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/lib/pq
Introduced in:
1.11.0 No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.