GPCC Login Page Information Leakage (GPDB Version and Host Info)

Products

• VMware Tanzu Greenplum
• VMware Tanzu Greenplum / Gemfire

Issue/Introduction

When performing security scans or inspecting the login page source code of Greenplum Command Center (GPCC), sensitive environment information is found in the gpccGlobal JavaScript object. This includes:

• gpdbMasterHost (Plain text Master hostname)
• gpdbMasterPort (Plain text Master port)
• gpdbVersion (Greenplum Database version)

gpccGlobal = {
        instanceName: 'gpcc',
        gpdbMasterHost: 'server1',
        gpdbMasterPort: '7432',
        gpccVersion: '6.17.1',
        gpdbVersion: '6.28.0',
        enableKerberos:  false ,
        enableOIDC:  false ,
        isLocalAuthSupported:  true ,
        needOIDCLogout:  false ,
...
...
}

Cause

This information was historically included in the gpccGlobal object for frontend processing but is flagged by security scanning tools as cleartext sensitive information leakage.

Resolution

This issue is resolved in GPCC 6.17.3 and later versions.

Workaround:

If an immediate upgrade is not possible, access to the GPCC port should be restricted via firewall rules to trusted networks/IPs only to mitigate the risk of unauthorized information gathering.

Additional Information

In Europa release October 20, 2026, R&D would remove all the other sensitive info on the login page as well. Refer to JIRA: TGP-31792