Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-104055 Details

Description

The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/canonical/charmed-postgresql-snap/pull/305	[email protected]
https://github.com/canonical/charmed-postgresql-snap/pull/307	[email protected]
https://github.com/canonical/postgresql-operator/pull/1863	[email protected]
https://github.com/canonical/postgresql-operator/security/advisories/GHSA-rcx7-7rh5-r542	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-532	Insertion of Sensitive Information into Log File	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes