Vulnerabilidades de cloudnative-pg (CVE)

Registros CVE publicados para cloudnative-pg, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

3 resultados

9.4Crítica

CVE-2026-55769 hace 2 meses

CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

cloudnative-pg cloudnative-pg

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/pro…

8.5Alta

CVE-2026-55765 hace 2 meses

CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

cloudnative-pg cloudnative-pg

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/ma…

9.4Crítica

CVE-2026-44477 hace 5 meses

CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

cloudnative-pg cloudnative-pg; Red Hat Red Hat Openshift Data Foundation 4

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then de…