H3-2026-0081¶
Patroni REST API Unauthenticated Configuration Write
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 9.8 |
Description¶
The Patroni REST API accepts PATCH requests to its /config endpoint without authentication, allowing arbitrary modification of the dynamic PostgreSQL HA cluster configuration via an RFC 7396 JSON Merge Patch. Patroni is a generic PostgreSQL high-availability/cluster-management tool embedded by multiple products, not specific to any single vendor. This is distinct from, and more severe than, the related unauthenticated read-only configuration disclosure (H3-2026-0080).
Impact¶
An unauthenticated attacker can write arbitrary keys into the Patroni dynamic configuration, including postgresql.parameters values such as archive_command. By then triggering a WAL archive event or a Patroni-driven configuration reload/restart, the attacker can achieve direct operating system command execution on the host running Patroni, without needing to separately harvest and replay a PostgreSQL credential.