CVE-2026-55765
Description
A flaw was found in CloudNativePG. Cleartext role passwords were recorded in pg_stat_statements, which could allow an untrusted tenant with pg_monitor or pg_read_all_stats privileges to recover superuser or application-owner passwords. This unauthorized access could enable the tenant to execute operating system commands within the database pod, resulting in remote code execution.
Statement
An IMPORTANT severity flaw was found in CloudNativePG as shipped in Red Hat OpenShift Data Foundation. CloudNativePG embedded cleartext role passwords in the ALTER ROLE and CREATE ROLE statements it generates, and when the PostgreSQL pg_stat_statements extension was preloaded with track_utility enabled, those cleartext passwords were recorded in its statistics. An untrusted tenant holding the pg_monitor or pg_read_all_stats role could read the recorded statements to recover the platform-managed superuser or application-owner password, reconnect through enabled superuser TCP access, and execute operating system commands inside the database pod via COPY ... FROM PROGRAM, resulting in remote code execution. Exploitation requires conditions that are absent from a default CloudNativePG deployment: pg_stat_statements must be preloaded with track_utility enabled, the tenant must be granted pg_monitor or pg_read_all_stats, and superuser TCP access (enableSuperuserAccess) must be enabled. Clusters that supply a SCRAM-SHA-256 verifier in managed-role Secrets are not affected even before the fix, because the recorded value is a non-replayable hash rather than a cleartext password. Within Red Hat OpenShift Data Foundation, resolution is delegated to the affected product's business unit, where a fix is being pursued; several OpenShift Data Foundation components were evaluated as not affected because the vulnerable code is not in their execution path. The Red Hat severity of IMPORTANT (CVSS 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) is consistent with the upstream assessment.
Mitigation
Operators who cannot upgrade immediately can reduce exposure by supplying a SCRAM-SHA-256 verifier in managed-role Secrets so that the value recorded by pg_stat_statements is a non-replayable hash rather than a cleartext password, by not granting pg_monitor or pg_read_all_stats to untrusted tenant roles, and by keeping superuser TCP access (enableSuperuserAccess) disabled so the postgres role cannot be reached over the network. Not preloading pg_stat_statements, or disabling pg_stat_statements.track_utility, also prevents utility statements containing the password literal from being recorded. The upstream project has fixed this issue in versions 1.28.4, 1.29.2, and 1.30.0, and upgrading to a fixed version is recommended.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.5 | N/A | 8.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resource. In some contexts, even storage of a plaintext password in memory is considered a security risk if the password is not cleared immediately after it is used.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
