CVE-2026-7428
Published: 12 May 2026
Summary
CVE-2026-7428 is a critical-severity Use of Default Credentials (CWE-1392) vulnerability in Google Cloud AlloyDB (inferred from references). Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 15.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29438
Vulnerability details
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to…
more
the database. Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Default password misconfiguration in publicly accessible cloud DB enables remote admin access via valid credentials (T1078) on exposed service (T1190).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates replacement of default credentials during secure configuration and provisioning procedures.
Policy requires changing or avoiding default credentials during system setup and operation.
Unique identification requirement prevents use of default or shared credentials by organizational users.
Changing default authenticators prior to first use prevents use of default credentials.
Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.
Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.
Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.
Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.