Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55765— CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

Quick assessment

Affected
cloudnative-pg cloudnative-pg
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CloudNativePG 是一个用于在 Kubernetes 环境中管理 PostgreSQL 数据库的平台。在版本 1.28.4 和 1.29.2 之前，CloudNativePG 会在由 中的 以及 中的 生成的 和 语句中嵌入明文角色密码。当启用了 并预加载了 模块时，拥有 或 权限的非信任租户可以恢复平台管理的超级用户或应用程序所有者密码，并通过启用的超级用户 TCP 访问重新连接，进而使用 在数据库 Pod 中执行操作系统命令。 使用 SCRAM-SHA-256 验证器的托管角色 Secret 中的集群

CVSS 8.5 · High EPSS 0.29% · P21

Affected Version Matrix 2

VendorProduct Version RangeStatus
cloudnative-pg cloudnative-pg < 1.28.4 affected
>= 1.29.0, < 1.29.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55765

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod
Source: CVE Program / CVE List V5
Vulnerability Description
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
明文存储口令
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cloudnative-pg cloudnative-pg < 1.28.4 -

II. Public POCs for CVE-2026-55765

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9710 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-55765

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55765 (1)

Vendor Advisories for CVE-2026-55765 (1)

Vendor Pages for CVE-2026-55765 (2)

IV. Related Vulnerabilities

Same product: cloudnative-pg
Same vendor: cloudnative-pg
Same weakness: CWE-256

V. Comments for CVE-2026-55765

No comments yet

Leave a comment