Vulnerability · Published Oct 2, 2026 · Assigned by canonical

CVE-2026-104055Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

Medium 5.3

In plain English

A medium-severity sensitive data in logs in postgresql-operator from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).

Affected products (as reported)

Vendor	Product	Versions
Canonical	postgresql-operator	0 – before 11890 – before 11900 – before 12160 – before 1217

Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References