Description

A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-10-06T19:18:16.280Z",
  "pubdate": "2026-10-06T19:18:16.280Z",
  "executiveSummary": "A critical vulnerability exists in postgres-exporter due to the unintentional exposure of Go's net/http/pprof debug endpoints on the metrics listener interface.\nThis vulnerability allows unauthenticated remote attackers positioned within the cluster network to access sensitive runtime diagnostic information.\nThe exposure enables the collection of heap dumps, process arguments, and execution stacks, which may contain plaintext database connection strings, credentials, and sensitive application state.\nAdditionally, the interface permits the initiation of CPU profiling, providing a vector for denial-of-service (DoS) attacks through resource exhaustion.\nThe vulnerability is primarily a configuration-level issue originating from the inclusion of the net/http/pprof package, which automatically registers handlers to the default HTTP multiplexer.\nGiven that these endpoints remain unauthenticated, any actor with network access to the metrics port can perform reconnaissance or exploit the exposed diagnostic features to compromise the security posture of the monitored database environment.",
  "technicalDetails": "The root cause of this vulnerability is the blank import of the net/http/pprof package within the postgres-exporter source code. In Go, importing net/http/pprof registers debug handler functions to the default HTTP server multiplexer (DefaultServeMux) as a side effect. Because the metrics server in postgres-exporter utilizes the default multiplexer, these debug endpoints are inadvertently exposed alongside the standard /metrics path.\nThe attack flow begins with network-level reconnaissance. An attacker with access to the cluster network identifies the port utilized by the postgres-exporter metrics listener. Upon sending HTTP GET requests to common pprof paths (such as /debug/pprof/heap, /debug/pprof/goroutine, or /debug/pprof/cmdline), the attacker bypasses any expected authentication—which is absent by default on the metrics listener—and receives the requested internal process data.\nExploitation of the heap profile (/debug/pprof/heap) is particularly critical, as it can yield memory snapshots containing database connection strings, credentials, or other sensitive runtime variables stored in heap-allocated memory. Similarly, /debug/pprof/goroutine provides a complete stack trace of all running goroutines, exposing internal application logic and potential execution states. Access to /debug/pprof/cmdline reveals the command-line arguments passed to the postgres-exporter process, which frequently include the very database credentials required for the exporter to operate.\nBeyond information disclosure, the attacker can leverage the CPU profiler endpoint (/debug/pprof/profile). By repeatedly initiating CPU profiling, the attacker forces the exporter to consume excessive CPU cycles and memory. Under high-traffic conditions, this synthetic load can lead to process instability or complete service interruption, resulting in a denial-of-service state for the monitoring infrastructure. The vulnerability does not require any specialized privileges, as the exposure occurs at the application level via the network, and the endpoints are inherently designed to operate without authentication when initialized via the blank import side effect.\nThis flaw affects any deployment of postgres-exporter where the binary was compiled with the net/http/pprof package included, exposing the default multiplexer to an unauthenticated network interface."
}