CVSS 4.0
6.0 mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-122043 enterprisedb repmgr: OS Command Injection
Medium (6.0) in enterprisedb repmgr. EPSS 1.0% estimated probability of exploitation activity in the next 30 days.
On this page
repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When event_notification_command is configured, repmgr substitutes the %a (node name), %c (connection string) and %d (details) placeholders into the command and runs it through the shell. %a and %c are inserted without escaping, and %d escapes only double quotes, so shell command substitution still works inside the quoting the documentation recommends. The node name and connection string come from node records in the repmgr.nodes table. An attacker with the credentials of a non-superuser repmgr database user can write a crafted node record and run OS commands, as the operating system user that runs repmgr or repmgrd (usually postgres), on other cluster nodes that process an event using these placeholders. The %a placeholder of failover_validation_command has the same flaw. Deployments whose repmgr database user is a superuser gain no new capability, because a superuser can already run OS commands, and deployments that do not use these placeholders are not affected. The issue is fixed in repmgr 5.5.1. After upgrading, operators must remove any quotes they placed around these placeholders, because a placeholder left inside double quotes is still open to command injection.
Severity
- EPSS
- 1.0% estimated probability of exploitation activity in the next 30 days; 64th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
- OWASP Top 10
- A05:2025 Injection
- Published
- Modified
- Assigned by
- EDB (CNA)
- NVD analysis
- Deferred: the NVD does not plan to analyze it
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-122043 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-122043?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-122043?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-122043 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-122043)
HTML:
<a href="https://cve.bz/cve/CVE-2026-122043"><img src="https://cve.bz/cve/badge/CVE-2026-122043.svg" alt="CVE-2026-122043"></a>
Affected
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| EnterpriseDB repmgr | from 4.0.0 before 5.5.1 |
Attack patterns (CAPEC)
- CAPEC-6 Argument Injection Likelihood: High · Severity: High
- CAPEC-15 Command Delimiters Likelihood: High · Severity: High
- CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
- CAPEC-88 OS Command Injection Likelihood: High · Severity: High
- CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.
History
- The NVD deferred its analysis
Changes since this site first stored the record. The same for every record: /api/public/changes.