CVE-2026-55769

creationtimestamp| type| source ---|---|--- 2026-08-21 00:09:47+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtkhu6n3dr2c 2026-08-21 00:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtkiyi54cc2c 2026-08-22 06:30:04+00:00| seen|...

CVE-2026-55769

CloudNativePG (a Kubernetes operator for PostgreSQL) is vulnerable to privilege escalation to superuser in versions prior to 1.28.4 and 1.29.2 . The root cause is that superuser connections in fillDefaultParameters (pkg/management/postgres/pool/profiles.go) did not pin search_path. An attacker wi...

CVE-2026-55769 CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...