Critical 9.4Published May 28, 2026

CVE-2026-44477CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

Updated under an hour ago (Oct 27, 2026, 3:23 AM ET)

Does this affect you?

It affects cloudnative-pg and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for cloudnative-pg

Exploited in the last 30 days

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.

CVSS: 9.4 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE): CWE-250, CWE-271, CWE-426
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

cloudnative-pg cloudnative-pg cloudnative_pg:cloudnative_pg (from the name)	before 1.28.3; from 1.29.0, < 1.29.1	CNA record
Red Hat Red Hat Openshift Data Foundation 4 redhat:openshift_data_foundation	4	CISA ADP
linuxfoundation cloudnativepg linuxfoundation:cloudnativepg	before 1.28.3; from 1.29.0 before 1.29.1	NVD

References

References

https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-423p-g724-fr39	x-refsource-confirm, mitigation, vendor-advisory
https://github.com/cloudnative-pg/cloudnative-pg/pull/10576	x-refsource-misc, issue-tracking, patch
https://access.redhat.com/security/cve/CVE-2026-44477
https://bugzilla.redhat.com/show_bug.cgi?id=2482763
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44477.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.