CloudNativePG Vuln Advisory: RCE via search_path injection, Auth Bypass, Password Leak (CVE-2026-56768/56765)

Based on the provided webpage screenshot, here is a summary of the key vulnerability information: Vulnerability Overview 1. CVE-2026-56768 / GHSA-x8c2-3p4r-vrr8: - Description: Search path pinning in connections issued by the operator. Database owners could place overloaded built-in functions in the public schema and allow that schema in the search path, allowing the operator to probe these overloads. Through the , CWE-426 privilege escalation chain (same as CVE-2018-1058), this could lead to arbitrary code execution within the Pod via . The operator now pins on each pooled connection and displays this in startup messages, prioritizing it over tenant-controlled defaults. - Impact: Could lead to arbitrary code execution within the Pod. - Fix: The operator now pins on each pooled connection. 2. GHSA-7pwx-3rrf-3pv9: - Description: Operator-to-Instance Manager authentication. The instance manager’s remote web server relied on network isolation for authentication rather than authentication between the operator and instance controller. Any component with access to the Pod status port could invoke it, compromising backups, WAL archival, and in-memory operation metadata. Upgrade-initiated startups are SHA-256 signed, preventing arbitrary code execution. The operator now generates a new ECDSA P-256 client certificate at startup and stores it in the status along with its SHA-256 fingerprint; the instance manager rejects requests unless a matching fingerprint is provided. This hardening is not backward compatible; earlier versions should continue to restrict access to the status port. - Impact: Could compromise backups, WAL archival, and in-memory operation metadata. - Fix: The operator now generates a new ECDSA P-256 client certificate at startup and stores it in the status along with its SHA-256 fingerprint. 3. CVE-2026-56765 / GHSA-w9gr-wx44-wm9j: - Description: Operator-instance SCRAM-SHA-256 password encoding. The operator now SCRAM-SHA-256 encodes client passwords instead of sending them in plaintext during , ensuring that existing PostgreSQL parsers (such as or ) capture SCRAM validators rather than passwords. Pre-hashed (MD5 or SCRAM) values are forwarded unchanged. The annotation serves as an exception. - Impact: Could lead to password capture. - Fix: The operator now SCRAM-SHA-256 encodes client passwords instead of sending them in plaintext during . Scope of Impact CVE-2026-56768 / GHSA-x8c2-3p4r-vrr8: Affects all users of CloudNativePG 1.31.0 and earlier, particularly database owners who place overloaded built-in functions in the public schema. GHSA-7pwx-3rrf-3pv9: Affects all users of CloudNativePG 1.31.0 and earlier, particularly those relying on network isolation for authentication. CVE-2026-56765 / GHSA-w9gr-wx44-wm9j: Affects all users of CloudNativePG 1.31.0 and earlier, particularly those using SCRAM-SHA-256 passwords. Remediation CVE-2026-56768 / GHSA-x8c2-3p4r-vrr8: The operator now pins on each pooled connection. GHSA-7pwx-3rrf-3pv9: The operator now generates a new ECDSA P-256 client certificate at startup and stores it in the status along with its SHA-256 fingerprint. CVE-2026-56765 / GHSA-w9gr-wx44-wm9j: The operator now SCRAM-SHA-256 encodes client passwords instead of sending them in plaintext during . POC Code or Exploit Code No specific POC code or exploit code was provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

CloudNativePG Vuln Advisory: RCE via search_path injection, Auth Bypass, Password Leak (CVE-2026-56768/56765)

More from this source