Description

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-20T22:17:22.487Z",
  "pubdate": "2026-08-20T22:17:22.487Z",
  "executiveSummary": "CloudNativePG contains a credential exposure vulnerability resulting from the generation of cleartext passwords within SQL statements prior to versions 1.28.4 and 1.29.2 (also fixed in 1.30.0).\nThe vulnerability allows untrusted tenants assigned with pg_monitor or pg_read_all_stats privileges to recover platform-managed superuser or application-owner credentials.\nThe attack requires the pg_stat_statements extension to be preloaded with track_utility enabled, enabling unauthorized users to capture plain-text credentials from query logs and statistics views.\nSuccessful exploitation grants attackers the ability to reconnect through enabled superuser TCP access and execute arbitrary operating system commands inside the database pod utilizing the COPY ... FROM PROGRAM command.\nClusters utilizing SCRAM-SHA-256 verifiers within managed-role Secrets are not susceptible to this security flaw.\nThe primary risk entails total compromise of the PostgreSQL database instance and potential lateral movement or code execution within the underlying Kubernetes pod environment.",
  "technicalDetails": "The root cause of the vulnerability stems from the improper handling of role passwords during generation and synchronization routines within the codebase, specifically embedded cleartext role passwords present in ALTER ROLE and CREATE ROLE statements.\nThe vulnerable components include SetUserPassword located in pkg/management/postgres/utils/roles.go and appendPasswordOption located in internal/management/controller/roles/postgres.go.\nAffected versions of CloudNativePG include all releases prior to 1.28.4 and 1.29.2.\nExploitation requires specific environmental configurations and permissions. An untrusted tenant must hold either the pg_monitor or pg_read_all_stats role.\nFurthermore, the PostgreSQL pg_stat_statements extension must be preloaded with the track_utility parameter enabled, which tracks utility commands including role creation and alteration statements containing the plain-text passwords.\nThe step-by-step attack flow begins when CloudNativePG reconciles database roles and executes statements containing cleartext passwords. These statements are logged and tracked by pg_stat_statements due to the track_utility configuration.\nAn untrusted tenant with monitoring privileges queries the pg_stat_statements view to extract the captured cleartext passwords associated with platform-managed superusers or application owners.\nArmed with the recovered administrative credentials, the attacker establishes a new database connection leveraging enabled superuser TCP access.\nWith superuser privileges established, the attacker executes arbitrary operating system commands within the context of the database pod by leveraging the PostgreSQL COPY ... FROM PROGRAM feature.\nPost-exploitation impact includes full administrative control over the database instance, unauthorized data access, and execution of arbitrary code on the container host environment."
}