CVE-2026-55769

Received Received - Intake

Privilege Escalation in CloudNativePG PostgreSQL Operator

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER could create overloaded built-in operators in the public schema and change the database or role search_path, causing instance-manager introspection queries such as SELECT COUNT(*) > 0 FROM pg_catalog.pg_extension WHERE extname = $1 to execute attacker-controlled functions as the postgres superuser. The same trust issue affected direct sql.Open("pgx", ...) callsites and the public.user_search SECURITY DEFINER function, enabling PostgreSQL superuser access, operating system command execution through COPY ... FROM PROGRAM, and access to the pod ServiceAccount token. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-55769

Affected Vendors & Products

Vendor	Product	Version / Range
cloudnativepg	cloudnativepg	to 1.28.4 (inc)
cloudnativepg	cloudnativepg	to 1.29.2 (inc)
cloudnativepg	cloudnativepg	1.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

CloudNativePG before versions 1.28.4 and 1.29.2 had a flaw where superuser connections were opened without properly restricting the search_path. This allowed a role with DATABASE OWNER privileges to create malicious operators in the public schema. These operators could then execute attacker-controlled functions as the postgres superuser during instance-manager queries.

Detection Guidance

To detect this vulnerability, check if your CloudNativePG version is below 1.28.4, 1.29.2, or 1.30.0. Run: kubectl get deployment -n <namespace> <deployment-name> -o jsonpath='{.spec.template.spec.containers[0].image}' to verify the version. If vulnerable, update immediately.

Impact Analysis

An attacker with DATABASE OWNER access could gain full PostgreSQL superuser privileges. This enables executing OS commands via COPY ... FROM PROGRAM, accessing the pod's ServiceAccount token, and performing unauthorized actions on the database or underlying system.

Compliance Impact

This vulnerability allows a DATABASE OWNER role to gain PostgreSQL superuser access and execute operating system commands via COPY ... FROM PROGRAM. This could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade CloudNativePG to version 1.28.4, 1.29.2, or 1.30.0 or later to address the vulnerability. Review and restrict roles with DATABASE OWNER privileges to prevent misuse of search_path and operator overloading.

Hi! I’m here to help you understand CVE-2026-55769. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70