PT-2026-55486 · Unknown · Cloudnativepg
CVE-2026-55769
·
Published
2026-07-01
·
Updated
2026-08-21
CVSS v4.0
9.4
Critical
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
CloudNativePG versions prior to 1.28.4
CloudNativePG versions prior to 1.29.2
Description
CloudNativePG fails to pin the
search path in the fillDefaultParameters function within pkg/management/postgres/pool/profiles.go when opening superuser connections. A user with DATABASE OWNER privileges can create overloaded built-in operators in the public schema and modify the database or role search path. This allows attacker-controlled functions to be executed as the postgres superuser during instance-manager introspection queries, such as SELECT COUNT(*) > 0 FROM pg catalog.pg extension WHERE extname = $1. This trust issue also affects direct sql.Open("pgx", ...) callsites and the public.user search SECURITY DEFINER function. Successful exploitation can lead to PostgreSQL superuser access, operating system command execution via COPY ... FROM PROGRAM, and unauthorized access to the pod ServiceAccount token.Recommendations
Update to version 1.28.4.
Update to version 1.29.2.
Exploit
Fix
Untrusted Search Path
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cloudnativepg