Insufficiently protected credentials in cloudnative-pg
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-256.
Summary
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cloudnative-pg | cloudnative-pg | before 1.28.4; 1.29.0 to before 1.29.2 | 1.28.4, 1.29.2 | Patch available | CNA |
- cloudnative-pg Vendorcloudnative-pg Affected before 1.28.4; 1.29.0 to before 1.29.2 Fixed in 1.28.4, 1.29.2 Patch available CNA
Remediation
- Fix · CNA cloudnative-pg (cloudnative-pg) Fixed in 1.28.4, 1.29.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
Not affected: 1 product
- Red Hat Openshift Data Foundation 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55765
References
Other 8
- https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-w3gf-xc94-wvmj
- https://github.com/cloudnative-pg/cloudnative-pg/pull/10724
- https://github.com/cloudnative-pg/cloudnative-pg/commit/2f0342747e1f160425b9d51753c0069b0d6117d5
- https://github.com/cloudnative-pg/cloudnative-pg/commit/3cd5af5d388c26758acf13c19ea806b4bcebb3fe
- https://github.com/cloudnative-pg/cloudnative-pg/commit/9a13573dbe3d78721b7ea92141e6d2324a2c0ef0
- https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.4
- https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.2
- https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.30.0
More cloudnative-pg vulnerabilities
- TI-2026-40258 Untrusted search path in cloudnative-pg CVSS 4.0CRITICAL 9.4
Sources
- CVE-2026-55765 · CVE Program
- CVE-2026-55765 · NVD
- FIRST EPSS
- CVE-2026-55765 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences