CVE-2017-7546: PostgreSQL improper authentication allows empty-password login

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 3.0 is 9.8 critical with network reachability and no privileges required, and EPSS is above the 99th percentile, so exposure is severe despite no KEV listing.

What it is

PostgreSQL before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 contains an incorrect authentication flaw that lets remote attackers authenticate to database accounts that have an empty password. Because the affected versions are widely deployed and the flaw bypasses normal credential checks, it exposes database contents and operations to unauthenticated network attackers.

Impact

An attacker gains access to database accounts with empty passwords, yielding read and write access to data and the ability to run SQL as that account. CVSS 3.0 rates it 9.8 critical with high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network via the PostgreSQL protocol (AV:N, PR:N, UI:N); no authentication or user interaction is required, though the target account must have an empty password.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is 0.61566 (99.1st percentile), indicating high predicted exploitation activity; references are vendor and third-party advisories only, with no public exploit tag.

What to do

• Upgrade PostgreSQL to 9.2.22, 9.3.18, 9.4.13, 9.5.8, 9.6.4 or later, or apply the relevant Debian, Red Hat or Gentoo errata.
• Immediately set non-empty passwords for every database role and audit for accounts with empty or NULL passwords.
• Restrict network access to PostgreSQL ports with firewall rules and bind listeners to trusted interfaces only.
• Enforce password authentication in pg_hba.conf and remove trust or ident rules that permit passwordless access.
• Monitor vendor advisories for the affected distribution packages and re-check after patching.

Detection

• Query pg_authid or pg_shadow for roles with empty or NULL password hashes.
• Review PostgreSQL connection and authentication logs for successful logins to accounts that should require a password.
• Alert on authentication events from unexpected source IPs or at unusual times against database accounts.
• Inventory PostgreSQL versions across hosts to find instances below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.