{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/cloudnativepg/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CloudNativePG \u003c 1.28.3","CloudNativePG \u003e= 1.29.0, \u003c 1.29.1"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","remote-code-execution","CVE-2026-44477","CloudNativePG"],"_cs_type":"advisory","_cs_vendors":["CloudNativePG"],"content_html":"\u003cp\u003eA critical vulnerability, CVE-2026-44477, exists in the CloudNativePG metrics exporter that allows a low-privileged database user to gain PostgreSQL superuser privileges and execute arbitrary OS commands as the \u003ccode\u003epostgres\u003c/code\u003e user inside the primary pod. This is due to the exporter initially connecting to PostgreSQL as the \u003ccode\u003epostgres\u003c/code\u003e superuser and then demoting privileges using \u003ccode\u003eSET ROLE pg_monitor\u003c/code\u003e, while retaining the superuser identity in the session. This vulnerability affects deployments using custom metric queries with unqualified identifiers and deployments with default monitoring enabled. The attacker can leverage \u003ccode\u003eRESET ROLE\u003c/code\u003e to recover superuser privileges and then use \u003ccode\u003eCOPY ... TO PROGRAM\u003c/code\u003e to execute OS-level subprocesses. Multi-tenant platforms that allow customers to influence custom metric queries are at the highest risk. Patches addressing this vulnerability have been released in versions 1.29.1 and 1.28.3 and later.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to a low-privileged database role (e.g., the default \u003ccode\u003eapp\u003c/code\u003e role).\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a target database being scraped by the CloudNativePG metrics exporter.\u003c/li\u003e\n\u003cli\u003e(Path 1: Custom Metric Queries) The attacker plants a shadow object (e.g., function, view) in a schema on the \u003ccode\u003esearch_path\u003c/code\u003e of the target database, with the same name as an unqualified identifier used in a custom metric query.\u003c/li\u003e\n\u003cli\u003e(Path 2: Default Monitoring) The attacker plants a shadow object named \u003ccode\u003ecurrent_database()\u003c/code\u003e in a user database, exploiting the unqualified call in the \u003ccode\u003epg_extensions\u003c/code\u003e metric.\u003c/li\u003e\n\u003cli\u003eWhen the metrics exporter next scrapes the database, the shadow object\u0026rsquo;s code is executed within the exporter\u0026rsquo;s \u003ccode\u003esession_user = postgres\u003c/code\u003e session.\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s code executes \u003ccode\u003eRESET ROLE\u003c/code\u003e to recover superuser privileges within the scrape session.\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s code then uses \u003ccode\u003eCOPY ... TO PROGRAM\u003c/code\u003e to execute an arbitrary OS command as the \u003ccode\u003epostgres\u003c/code\u003e user inside the primary pod.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary OS command execution inside the database pod, potentially leading to further lateral movement or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows privilege escalation from a low-privileged database role to PostgreSQL superuser, combined with arbitrary OS command execution as the \u003ccode\u003epostgres\u003c/code\u003e user inside the primary pod. A web application SQL injection vulnerability in an app backed by a CloudNativePG cluster is sufficient to pivot to database-pod RCE. All deployments with default monitoring enabled or custom metric queries containing unqualified catalog references are affected. Multi-tenant platforms are at the highest risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade CloudNativePG to v1.28.3 or later, or v1.29.1 or later to incorporate the fixes described in the advisory, specifically addressing CVE-2026-44477.\u003c/li\u003e\n\u003cli\u003eApply the workaround by schema-qualifying all identifiers in custom metric queries as described in the advisory, using explicit \u003ccode\u003epg_catalog.\u003c/code\u003e prefixes.\u003c/li\u003e\n\u003cli\u003eRestrict database ownership to fully trusted roles, ensuring only these roles own user databases in scraped clusters to limit the exploit\u0026rsquo;s impact, per the advisory recommendations.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect CloudNativePG Postgres User Pod RCE\u0026rdquo; to identify potential exploitation attempts leveraging the COPY command to program, based on process creation logs.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect CloudNativePG Metrics Exporter PrivEsc via Shadowed current_database\u0026rdquo; to detect the shadowing of current_database function.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-11T16:01:46Z","date_published":"2026-05-11T16:01:46Z","id":"https://feed.craftedsignal.io/briefs/2026-05-cnpg-privesc/","summary":"CVE-2026-44477 allows a low-privileged database user to escalate to PostgreSQL superuser and achieve OS command execution as the `postgres` user within the primary pod by exploiting the metrics exporter's superuser connection via custom metric queries or the default configuration.","title":"CloudNativePG Metrics Exporter Privilege Escalation and RCE (CVE-2026-44477)","url":"https://feed.craftedsignal.io/briefs/2026-05-cnpg-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed — CloudNativePG","version":"https://jsonfeed.org/version/1.1"}