CVE-2026-78155

Name of the Vulnerable Software and Affected Versions StackGres versions prior to 1.18.9

Description A privilege escalation issue exists in the StackGres operator, which is used to deploy and manage PostgreSQL clusters on Kubernetes. A low-privilege tenant who owns a database can bypass isolation boundaries to gain administrator privileges. This occurs because the metrics exporter connects to PostgreSQL with superuser privileges and executes queries in tenant-controlled databases without sufficiently constraining the PostgreSQL search path. An attacker can influence object resolution, allowing a database object under their control to execute with elevated privileges, potentially leading to OS command execution inside the PostgreSQL pod, read/write access to co-located databases, and lateral movement within the cluster.

Recommendations Update StackGres to version 1.18.9 or later.