Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-44477CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

High 8.8

In plain English

A high-severity security flaw in cloudnative-pg from cloudnative-pg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/cloudnative-pg/cloudnative-pg1.28.3GHSA-423p-g724-fr39
Gogithub.com/cloudnative-pg/cloudnative-pg1.29.1GHSA-423p-g724-fr39
Gogithub.com/cloudnative-pg/cloudnative-pg1.28.3, 1.29.1GO-2026-5106

Affected products (as reported)

VendorProductVersions
cloudnative-pg cloudnative-pg < 1.28.3>= 1.29.0, < 1.29.1

Weakness: CWE-250, CWE-271, CWE-426 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References