CVE-2026-55765 cloudnative-pg CVE debrief

Who should care

Defenders managing Kubernetes environments using CloudNativePG, especially those with untrusted tenants, should assess exposure and prioritize verification. This includes reviewing current deployments, checking for untrusted tenant access to sensitive features, and ensuring appropriate mitigations are in place.

Why it matters

CVE-2026-55765 allows untrusted tenants to recover sensitive passwords and execute operating system commands, requiring defenders to verify exposure and prioritize remediation.

• Recovery of platform-managed superuser or application-owner passwords by untrusted tenants
• Execution of operating system commands in the database pod with `COPY ... FROM PROGRAM`
• Potential for lateral movement and privilege escalation
• Verification of exposure and remediation priority

Technical summary

CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. Untrusted tenants could recover platform-managed superuser or application-owner passwords and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.

Defensive priority

Defenders should prioritize verifying exposure in Kubernetes environments using CloudNativePG, especially those with untrusted tenants.

Recommended defensive actions

• Verify exposure in Kubernetes environments using CloudNativePG
• Check if untrusted tenants have access to pg_stat_statements with track_utility enabled
• Upgrade to versions 1.28.4, 1.29.2, or 1.30.0
• Review and update Secrets using SCRAM-SHA-256 verifiers
• Monitor for suspicious activity related to pg_stat_statements and `COPY ... FROM PROGRAM`
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source references provide details on the vulnerability, affected versions 1.28.3, 1.29.1, and 1.30.0-beta, and fixed versions 1.28.4, 1.29.2, and 1.30.0. The vulnerability allows untrusted tenants to recover platform-managed superuser or application-owner passwords and execute operating system commands. pg_stat_statements must be preloaded with track_utility enabled and an untrusted tenant must hold pg_monitor or pg_read_all_stats.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.