Skip to content
Threat Feed

Product

CloudNativePG >= 1.29.0, < 1.29.1

1 brief RSS
critical advisory

CloudNativePG Metrics Exporter Privilege Escalation and RCE (CVE-2026-44477)

CVE-2026-44477 allows a low-privileged database user to escalate to PostgreSQL superuser and achieve OS command execution as the `postgres` user within the primary pod by exploiting the metrics exporter's superuser connection via custom metric queries or the default configuration.

CloudNativePG < 1.28.3 +1 privilege-escalation remote-code-execution CVE-2026-44477 CloudNativePG
2r 2t