CVE-2026-55769

creationtimestamp| type| source ---|---|--- 2026-08-21 00:09:47+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtkhu6n3dr2c 2026-08-21 00:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtkiyi54cc2c 2026-08-22 06:30:04+00:00| seen|...

CVE-2026-55769 CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

CVE-2026-55769

CloudNativePG (a Kubernetes operator for PostgreSQL) is vulnerable to privilege escalation to superuser in versions prior to 1.28.4 and 1.29.2 . The root cause is that superuser connections in fillDefaultParameters (pkg/management/postgres/pool/profiles.go) did not pin search_path. An attacker wi...

kubectl-cnpg-1.29.2-1.1 on GA media (moderate)

kubectl-cnpg-1.29.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11167-1 Rating: moderate Cross-References: CVE-2018-1058 CVE-2026-55765 CVE-2026-55769 CVSS scores: CVE-2018-1058 SUSE : 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that...