CVE-2026-44477 CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

🗓️ 28 May 2026 15:46:12Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

Before fixes, CloudNativePG metrics exporter can regain superuser privileges and run OS commands.

Reporter	Title	Published	Views	Family All 28
ATTACKERKB	CVE-2026-44477	28 May 202615:46	–	attackerkb
Chainguard	CVE-2026-44477 vulnerabilities	12 May 202613:18	–	cgr
Circl	CVE-2026-44477	18 May 202604:30	–	circl
CNNVD	CloudNativePG 代码问题漏洞	28 May 202600:00	–	cnnvd
CVE	CVE-2026-44477	28 May 202615:46	–	cve
Cvelist	CVE-2026-44477 CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE	28 May 202615:46	–	cvelist
EUVD	EUVD-2026-32930	28 May 202615:46	–	euvd
Github Security Blog	CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE	11 May 202615:59	–	github
NVD	CVE-2026-44477	28 May 202617:16	–	nvd
OSV	CGA-9X7Q-44F8-4RQF	12 May 202616:47	–	osv

Source	Link
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44477.json
access	www.access.redhat.com/security/cve/CVE-2026-44477
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44477.json
github	www.github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-423p-g724-fr39
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44477
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/cloudnative-pg/cloudnative-pg/pull/10576

08 Jul 2026 08:15Current

6Medium risk

Vulners AI Score6

CVSS 49.4

EPSS0.0048

CloudNativePG metrics exporter privilege escalation PostgreSQL superuser operating system commands