This vulnerability involves the use of default credentials in Google Cloud AlloyDB for PostgreSQL clusters created before 2025-11-03 using Terraform or the REST API. The default password was insecure, enabling remote attackers with network access to the cluster to potentially gain full administrative privileges. Other clients besides Terraform and REST API blocked this insecure setup, limiting the attack surface. The vulnerability is tracked as CWE-1392 and has a critical CVSS 4.0 score of 9.2. Being a cloud-hosted service, remediation is managed by Google Cloud, and a patch is available.

If exploited, an attacker could gain full administrative access to the affected AlloyDB cluster, potentially compromising all data and operations within the database. The attack requires network access and use of Terraform or REST API to create vulnerable clusters. No known exploits in the wild have been reported. The vulnerability poses a critical risk to confidentiality, integrity, and availability of the database service.

Since AlloyDB for PostgreSQL is a cloud service, Google Cloud manages the remediation and patching process. Users should ensure that their clusters are created after 2025-11-03 or verify that patches have been applied by the vendor. Check the official Google Cloud advisory for confirmation of patch deployment and any additional recommended actions. No further user action is required if the service is up to date.