CVE-2000-1199: PostgreSQL stores usernames and passwords in plaintext in (1) pg_shadow and (2) pg_pwd, which allows attack...

Security readout for executives and security teams

This old PostgreSQL issue concerns passwords stored in plaintext in pg_shadow and pg_pwd. If someone already has sufficient privilege to read those locations, they could recover credentials and access databases as those users. The provided sources do not identify active exploitation, current affected versions, or a specific patch. Likely exposure is limited to legacy PostgreSQL deployments matching the 2000-era advisory. The bundle lists affected vendor, product, and versions as unavailable, so exposure cannot be determined from the CVE record alone. Treat as an exposure-management issue for legacy databases. Prioritize if the organization still runs old PostgreSQL, stores sensitive data, or has weak administrator access controls. Otherwise, track as historical with uncertain applicability. Mitigation focus: Inventory PostgreSQL versions and identify legacy systems matching this advisory period.; Check PostgreSQL vendor guidance for supported upgrade and password storage behavior.; Restrict database superuser and server filesystem access to trusted administrators..

Prepared

Jul 1, 2026, 08:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.