Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55765— CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

Quick assessment

Affected
cloudnative-pg cloudnative-pg
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CloudNativePG是CloudNativePG团队的一款消息队列中间件。 CloudNativePG 1.28.4之前版本和1.29.0至1.29.2之前版本存在信任管理问题漏洞，该漏洞源于在ALTER ROLE和CREATE ROLE语句中嵌入明文角色密码，且pg_stat_statements预加载并启用track_utility时，具有pg_monitor或pg_read_all_stats权限的不可信租户可恢复平台管理的超级用户或应用所有者密码，进而通过超级用户TCP访问执行操作系统命令。

CVSS 8.5 · High EPSS 0.50% · P41

Affected Version Matrix 2

VendorProduct Version RangeStatus
cloudnative-pg cloudnative-pg < 1.28.4 affected
>= 1.29.0, < 1.29.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55765

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod
Source: CVE Program / CVE List V5
Vulnerability Description
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
明文存储口令
Source: CVE Program / CVE List V5
Vulnerability Title
CloudNativePG 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CloudNativePG是CloudNativePG团队的一款消息队列中间件。 CloudNativePG 1.28.4之前版本和1.29.0至1.29.2之前版本存在信任管理问题漏洞，该漏洞源于在ALTER ROLE和CREATE ROLE语句中嵌入明文角色密码，且pg_stat_statements预加载并启用track_utility时，具有pg_monitor或pg_read_all_stats权限的不可信租户可恢复平台管理的超级用户或应用所有者密码，进而通过超级用户TCP访问执行操作系统命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
cloudnative-pg cloudnative-pg < 1.28.4 -

II. Public POCs for CVE-2026-55765

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9710 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-55765

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55765 (1)

Vendor Advisories for CVE-2026-55765 (1)

Vendor Pages for CVE-2026-55765 (2)

IV. Related Vulnerabilities

Same product: cloudnative-pg
Same vendor: cloudnative-pg
Same weakness: CWE-256

V. Comments for CVE-2026-55765

No comments yet

Leave a comment