CVE-2026-55765

Name of the Vulnerable Software and Affected Versions CloudNativePG versions prior to 1.28.4 CloudNativePG versions prior to 1.29.2

Description CloudNativePG embeds cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by the SetUserPassword() and appendPasswordOption() functions. If pg stat statements is preloaded with track utility enabled and an untrusted tenant possesses pg monitor or pg read all stats permissions, the tenant can recover platform-managed superuser or application-owner passwords. This could allow the tenant to reconnect via enabled superuser TCP access and execute operating system commands in the database pod using COPY ... FROM PROGRAM. Clusters utilizing SCRAM-SHA-256 verifiers in managed-role Secrets are not affected.

Recommendations Update to version 1.28.4. Update to version 1.29.2.