CVE-2026-55765: CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pgstatstatements was preloaded with trackutility enabled and an untrusted tenant held pgmonitor or pgreadallstats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with COPY ... FROM PROGRAM. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CloudNativePGto a version that resolves this vulnerability.Fixed in 1.28.4 - Upgrade
Upgrade
CloudNativePGto a version that resolves this vulnerability.Fixed in 1.29.2 - Upgrade
Upgrade
CloudNativePGto a version that resolves this vulnerability.Fixed in 1.30.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Affected deployments are CloudNativePG versions before 1.28.4 or 1.29.2 where pg_stat_statements is preloaded with track_utility enabled, an untrusted tenant has pg_monitor or pg_read_all_stats, and superuser TCP access is enabled. Deployments whose managed-role Secrets use SCRAM-SHA-256 verifiers are not affected.
What access does an attacker need?
The attacker needs a tenant role that is not trusted but has either pg_monitor or pg_read_all_stats. They also need the affected pg_stat_statements configuration to retrieve cleartext passwords recorded in role-management utility statements.
What can an attacker do after recovering a password?
A recovered platform-managed superuser or application-owner password can be used to reconnect through enabled superuser TCP access. The attacker can then execute operating-system commands in the database pod using COPY ... FROM PROGRAM.
What versions fix the issue?
The issue is fixed in CloudNativePG 1.28.4, 1.29.2, and 1.30.0.