CVE-2026-44477 Details
Description
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.
A vulnerability in the CloudNativePG metrics exporter prior to versions 1.29.1 and 1.28.3 allows for privilege escalation to PostgreSQL superuser and arbitrary OS command execution as the postgres user inside the primary pod. This issue arises because the exporter opens a PostgreSQL connection as the postgres superuser via a pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. However, the session_user remains postgres, allowing exploitation by invoking RESET ROLE to regain superuser privileges and using COPY ... TO PROGRAM to execute commands at the OS level.
Users can upgrade to CloudNativePG versions 1.29.1 or 1.28.3, where this vulnerability has been patched. If an immediate upgrade is not possible, users can schema-qualify all identifiers in custom metric queries, restrict database ownership to trusted roles, limit the scope of target_databases queries, and avoid exposing metric query SQL to untrusted users.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-44477 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2482763 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44477.json | redhat-SADP | |
| https://github.com/cloudnative-pg/cloudnative-pg/pull/10576 | [email protected] | Issue TrackingPatch |
| https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-423p-g724-fr39 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | redhat-SADP |
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
| CWE-271 | Privilege Dropping / Lowering Errors | [email protected] |
| CWE-426 | Untrusted Search Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation cloudnativepg | < 1.28.3 >= 1.29.0, < 1.29.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |