REDHAT-BUG-2482763: High severity CloudNativePG CloudNativePG metrics exporter vulnerability
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pgmonitor. SET ROLE changes only currentuser; sessionuser remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CloudNativePGto a version that resolves this vulnerability.Fixed in 1.29.1 - Upgrade
Upgrade
CloudNativePGto a version that resolves this vulnerability.Fixed in 1.28.3
Event History
Frequently Asked Questions
Which CloudNativePG versions are affected?
CloudNativePG versions prior to 1.29.1 and 1.28.3 are affected. The issue is fixed in 1.29.1 and 1.28.3.
What would an attacker need to exploit this issue?
An attacker would need a way to have a SQL expression evaluated within a metrics scrape session. From that session, they can use RESET ROLE to regain the postgres superuser privileges retained as session_user.
What is the impact after successful exploitation?
The attacker can use COPY ... TO PROGRAM to start an operating-system subprocess as the postgres user inside the primary pod. The scrape transaction being marked READ ONLY does not prevent this because it does not restrict external process execution.