CVE-2026-55769 CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

EUVD-2026-63685

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-55765

CloudNativePG (a Kubernetes-based PostgreSQL management platform) prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword and appendPasswordOption. When pg_stat_statements was preloaded with track_utility enabled, an untru...

CVE-2026-55765 CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-14677 affecting package postgresql for versions less than 16.15-1

CVE-2026-14677 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-16239 affecting package postgresql for versions less than 16.15-1

CVE-2026-16239 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14664 affecting package postgresql for versions less than 16.15-1

CVE-2026-14664 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14670 affecting package postgresql for versions less than 16.15-1

CVE-2026-14670 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14668 affecting package postgresql for versions less than 16.15-1

CVE-2026-14668 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15741 affecting package postgresql for versions less than 16.15-1

CVE-2026-15741 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14678 affecting package postgresql for versions less than 16.15-1

CVE-2026-14678 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14666 affecting package postgresql for versions less than 16.15-1

CVE-2026-14666 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15742 affecting package postgresql for versions less than 16.15-1

CVE-2026-15742 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-6470 affecting package postgresql for versions less than 16.15-1

CVE-2026-6470 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-18024 affecting package postgresql for versions less than 16.15-1

CVE-2026-18024 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14663 affecting package postgresql for versions less than 16.15-1

CVE-2026-14663 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14672 affecting package postgresql for versions less than 16.15-1

CVE-2026-14672 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14671 affecting package postgresql for versions less than 16.15-1

CVE-2026-14671 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-6464 affecting package postgresql for versions less than 16.15-1

CVE-2026-6464 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-16241 affecting package postgresql for versions less than 16.15-1

CVE-2026-16241 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...