Skip to main content

SEC.AUTH.HBA_OPEN_CIDR — The line accepts the whole address space

  • Category: security
  • Severity: high
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about how the server authenticates, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: PostgreSQL 18

Not a breach on its own — the multiplier​

A line open to 0.0.0.0/0 still demands whatever its auth method demands. If that is scram-sha-256, an attacker needs the password. What the open range removes is the requirement to be anywhere in particular first, which turns a bounded risk into an internet-facing one: credential stuffing, version fingerprinting, and every future weakness in the authentication path.

One fact, four spellings​

pg_hba.conf writes the same statement four ways, and pg_hba_file_rules splits some of them across two columns:

host all all all               scram-sha-256
host all all 0.0.0.0/0         scram-sha-256
host all all 0.0.0.0 0.0.0.0   scram-sha-256
host all all ::/0              scram-sha-256

SQLens reads the canonicalized address rather than the text, so all four produce the same finding. samehost and samenet do not: they resolve to the server's own addresses and narrow the line.

Bad​

host    all    all    0.0.0.0/0    scram-sha-256

Good​

hostssl all    app    10.0.4.0/24  scram-sha-256
hostssl all    app    2001:db8:4::/64  scram-sha-256

If the connections genuinely come from anywhere — a managed platform with rotating egress — put the boundary somewhere that can hold one: a private network, a proxy with a fixed address, or the provider's own allow-list.

When the same line also carries a weak method, this finding names it and points at the rule that reports it — SEC.AUTH.HBA_TRUST, SEC.AUTH.HBA_CLEARTEXT or SEC.AUTH.HBA_MD5 — and that one is the finding to fix first.