CVE-2026-44477
Description
A flaw was found in CloudNativePG's metrics exporter. The issue arises because the metrics exporter connected to PostgreSQL using a highly privileged account and did not properly restrict privileges during monitoring operations. A low-privileged database user could exploit this behavior through crafted monitoring queries or PostgreSQL object resolution manipulation to regain PostgreSQL superuser privileges and potentially execute arbitrary operating system commands as the postgres user inside the affected database pod.
Statement
This vulnerability affects CloudNativePG's monitoring and metrics export functionality. The attacker may exploit the affected monitoring functionality to escalate privileges within the PostgreSQL environment and potentially execute arbitrary operating system commands as the postgres user inside the affected database pod.
Red Hat Product Security has rated this issue as an Important severity vulnerability rather than Critical.
A successful exploitation requires access to a valid database account. A low-privileged authenticated database user (PR:L) is needed.
Although exploitation may result in PostgreSQL superuser access and command execution within the affected pod, the impact remains limited to the affected PostgreSQL and container environment. It does not lead to container escape, Kubernetes cluster compromise, or host level privilege escalation. Therefore, Scope is assessed as Unchanged (S:U).
Because successful exploitation may allow disclosure, modification, or disruption of database contents, as well as arbitrary command execution within the affected pod, Red Hat assessed the Confidentiality, Integrity, and Availability impacts as High (C:H/I:H/A:H).
Mitigation
- Avoid using unqualified identifiers in custom monitoring queries
- Restrict ownership of user-controlled schemas and database objects
- Avoid unnecessary exposure of monitoring query configuration to untrusted users
- Avoid using broad monitoring configurations such as:
target_databases: '*'unless all databases and users are trusted.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | 9.9 | 8.8 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Changed | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands; Read Application Data; DoS: Crash, Exit, or Restart
An attacker will be able to gain access to any resources that are allowed by the extra privileges. Common results include executing code, disabling services, and reading restricted data. New weaknesses can be exposed because running with extra privileges, such as root or Administrator, can disable the normal security checks being performed by the operating system or surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if they occur while operating at raised privileges.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
