CVE-2026-55769
CriticalCVSS 9.4Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
CloudNativePG before versions 1.28.4 and 1.29.2 opened superuser connections without pinning search_path, allowing a role with DATABASE OWNER to execute attacker-controlled functions as the postgres superuser, including OS command execution and access to the pod ServiceAccount token.
Risk Assessment
Risk of full compromise of the PostgreSQL database, OS command execution, and theft of service account tokens in Kubernetes environments.
Recommendation
Upgrade CloudNativePG to version 1.28.4, 1.29.2, or 1.30.0 and review role permissions in databases.
Other vulnerabilities in CloudNativePG
See all- CVE-2026-44477Critical
CloudNativePG before versions 1.29.1 and 1.28.3 has a vulnerability in the metrics exporter that connects as the postgres superuser via a Unix socket and then demotes privileges with SET ROLE pg_monitor. An attacker can use RESET ROLE to regain superuser privileges and execute arbitrary system commands via COPY ... TO PROGRAM.
- CVE-2026-55765High
CloudNativePG prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements. With pg_stat_statements and track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats could recover platform-managed passwords and execute OS commands in the database pod. Fixed in 1.28.4, 1.29.2, and 1.30.0.
Original NVD description (English source)
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER could create overloaded built-in operators in the public schema and change the database or role search_path, causing instance-manager introspection queries such as SELECT COUNT(*) > 0 FROM pg_catalog.pg_extension WHERE extname = $1 to execute attacker-controlled functions as the postgres superuser. The same trust issue affected direct sql.Open("pgx", ...) callsites and the public.user_search SECURITY DEFINER function, enabling PostgreSQL superuser access, operating system command execution through COPY ... FROM PROGRAM, and access to the pod ServiceAccount token. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS