GO-2026-6169

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6169

Import Source

https://vuln.go.dev/ID/GO-2026-6169.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6169

Aliases

CVE-2026-56870

Withdrawn

2026-08-18T20:22:44Z

Published

2026-08-18T16:38:10Z

Modified

2026-08-19T17:30:29.979279535Z

Summary

WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq

Details

(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost and the remote address, the driver selects the secret intended for the local database and sends it to the remote endpoint when that endpoint requests password authentication.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6169"
}

References

https://github.com/golang/vulndb/issues/6169

Affected packages

Go / github.com/lib/pq

Package

Name: github.com/lib/pq; View open source insights on deps.dev
Purl: pkg:golang/github.com/lib/pq

Affected ranges

Type: SEMVER
Events: Introduced

1.11.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/lib/pq",
            "symbols": [
                "Connector.Connect",
                "DialOpen",
                "Driver.Open",
                "NewDialListener",
                "NewListener",
                "NewListenerConn",
                "Open"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6169.json"