H3-2026-0080¶

Patroni REST API Unauthenticated Configuration Disclosure

Description¶

The Patroni REST API exposes its /config endpoint without authentication, disclosing the full dynamic PostgreSQL HA cluster configuration in cleartext, including user passwords. Patroni is a generic PostgreSQL high-availability/cluster management tool embedded by multiple products, not specific to any single vendor.

Impact¶

An unauthenticated attacker can retrieve PostgreSQL user credentials, including superuser passwords, directly from the Patroni REST API and use them to authenticate to the backing PostgreSQL service.

References¶

• Patroni REST API Security
• MITRE ATT&CK Technique: T1552.001: Unsecured Credentials: Credentials In Files