CVE-2026-55765

Received Received - Intake

Cleartext Password Exposure in CloudNativePG Kubernetes PostgreSQL

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-55765

Affected Vendors & Products

Vendor	Product	Version / Range
cloudnativepg	cloudnativepg	to 1.28.4 (inc)
cloudnativepg	cloudnativepg	to 1.29.2 (inc)
cloudnativepg	cloudnativepg	1.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-256	The product stores a password in plaintext within resources such as memory or files.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

CloudNativePG before versions 1.28.4 and 1.29.2 had a flaw where cleartext role passwords were embedded in SQL statements like ALTER ROLE and CREATE ROLE. This occurred in functions SetUserPassword and appendPasswordOption. An attacker with specific database privileges could exploit this to recover passwords and execute OS commands via COPY ... FROM PROGRAM.

Detection Guidance

Check CloudNativePG versions for affected releases (prior to 1.28.4, 1.29.2, or 1.30.0). Inspect PostgreSQL role passwords in logs or configuration for cleartext entries in ALTER ROLE or CREATE ROLE statements. Monitor for unauthorized TCP access or COPY ... FROM PROGRAM commands executed by untrusted tenants.

Impact Analysis

If exploited, an attacker could gain superuser access to the PostgreSQL database, execute arbitrary operating system commands within the database pod, and potentially take control of the Kubernetes environment hosting CloudNativePG. This could lead to data breaches or full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. A data breach could result in significant fines, legal penalties, and reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Upgrade CloudNativePG to versions 1.28.4, 1.29.2, or 1.30.0 or later to address the vulnerability. Ensure clusters use SCRAM-SHA-256 verifiers in managed-role Secrets. Review and rotate any exposed superuser or application-owner passwords.

Hi! I’m here to help you understand CVE-2026-55765. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70