pgEdge Control Plane versions prior to 0.11.0 generate a pg_hba.conf file that begins with hard-coded 'trust' authentication entries for local and loopback connections. This configuration allows any local operating-system user on the database host to connect to Postgres as any role, including superuser, without credentials. The issue is more severe in systemd deployments where the database runs on a shared multi-user host. The vulnerability is fixed in version 0.11.0, which removes these trust entries and respects operator-supplied authentication rules.