Privilege Dropping / Lowering Errors

Overview Affected versions of this package are vulnerable to Privilege Dropping / Lowering Errors in the metrics exporter. An attacker can gain PostgreSQL superuser privileges and execute arbitrary OS commands as the postgres user inside the primary pod by exploiting the ability to plant shadow...

GHSA-423P-G724-FR39 CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

Impact The CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pgmonitor. SET ROLE changes only currentuser; sessionuser remains postgres. That residual superuser identity is the foothold fo...

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

Impact The CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pgmonitor. SET ROLE changes only currentuser; sessionuser remains postgres. That residual superuser identity is the foothold fo...

Privilege Dropping / Lowering Errors

Overview Affected versions of this package are vulnerable to Privilege Dropping / Lowering Errors in the metrics exporter. An attacker can gain PostgreSQL superuser privileges and execute arbitrary OS commands as the postgres user inside the primary pod by exploiting the ability to plant shadow...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2332 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.9.0, <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.9.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.0.68 and more Source cves: CVE-2026-44902 Source advisor...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2332 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.9.0, <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.9.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.0.68 and more Source cves: CVE-2026-44902 Source advisor...

GHSA-Q7RR-3CGH-J5R3 Prometheus exporter process crash via malformed HTTP request

Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. You...

Prometheus exporter process crash via malformed HTTP request

Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. You...

Improper Handling of Exceptional Conditions

Overview @opentelemetry/exporter-prometheus is an OpenTelemetry Exporter Prometheus provides a metrics endpoint for Prometheus Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the PrometheusExporter process. An attacker can cause the process to...

PT-2026-39753

Name of the Vulnerable Software and Affected Versions CloudNativePG versions prior to 1.28.3 CloudNativePG versions prior to 1.29.1 Description The metrics exporter in CloudNativePG opens a PostgreSQL connection as the postgres superuser via the pod-local Unix socket and subsequently demotes the...

PT-2026-39676

Name of the Vulnerable Software and Affected Versions opentelemetry-js versions prior to 0.217.0 Description A single malformed HTTP request can crash any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default '0.0.0.0:9464' lacks error handling during URL...

GHSA-3V2C-X6Q9-F697 vulnerabilities

Vulnerabilities for packages: argo-cd, vault-benchmark, rke2-runtime-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, splunk-otel-collector, trufflehog-fips, libnvidia-container, kubescape-operator-fips, ops-agent, cert-manager-google-cas-issuer-fips, kserve-localmodelnode-agent-fips,...

CVE-2026-39823 vulnerabilities

Vulnerabilities for packages: argo-cd, vault-benchmark, rke2-runtime-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, splunk-otel-collector, trufflehog-fips, libnvidia-container, kubescape-operator-fips, ops-agent, cert-manager-google-cas-issuer-fips, kserve-localmodelnode-agent-fips,...

GHSA-2283-WF8C-RW8R vulnerabilities

Vulnerabilities for packages: argo-cd, vault-benchmark, rke2-runtime-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, splunk-otel-collector, trufflehog-fips, libnvidia-container, kubescape-operator-fips, ops-agent, cert-manager-google-cas-issuer-fips, kserve-localmodelnode-agent-fips,...

CVE-2026-39826 vulnerabilities

Vulnerabilities for packages: argo-cd, vault-benchmark, rke2-runtime-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, splunk-otel-collector, trufflehog-fips, libnvidia-container, kubescape-operator-fips, ops-agent, cert-manager-google-cas-issuer-fips, kserve-localmodelnode-agent-fips,...

CVE-2026-39817 vulnerabilities

Vulnerabilities for packages: argo-cd, container-object-storage-interface, vault-benchmark, kubernetes-replicator-fips, rke2-runtime-fips, flannel-cni-plugin-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, hclmerge-fips, litmus-chaos-operator-fips, hcledit, splunk-otel-collector,...

CVE-2026-42501 vulnerabilities

Vulnerabilities for packages: argo-cd, container-object-storage-interface, vault-benchmark, kubernetes-replicator-fips, rke2-runtime-fips, flannel-cni-plugin-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, hclmerge-fips, litmus-chaos-operator-fips, hcledit, splunk-otel-collector,...

CVE-2026-39819 vulnerabilities

Vulnerabilities for packages: argo-cd, container-object-storage-interface, vault-benchmark, kubernetes-replicator-fips, rke2-runtime-fips, flannel-cni-plugin-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, hclmerge-fips, litmus-chaos-operator-fips, hcledit, splunk-otel-collector,...

GHSA-QF3Q-3H68-MMH2 vulnerabilities

Vulnerabilities for packages: argo-cd, container-object-storage-interface, vault-benchmark, kubernetes-replicator-fips, rke2-runtime-fips, flannel-cni-plugin-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, hclmerge-fips, litmus-chaos-operator-fips, hcledit, splunk-otel-collector,...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: argo-cd, container-object-storage-interface, vault-benchmark, kubernetes-replicator-fips, rke2-runtime-fips, cortex-fips, crossplane-provider-aws-sesv2-fips, hclmerge-fips, litmus-chaos-operator-fips, hcledit, splunk-otel-collector, libnvidia-container,...