CVE-2026-44477
CWE-250Published: May 28, 2026· Updated: Jun 3, 2026
Official Description
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.
Risk Analysis
This critical vulnerability in CloudNativePG allows an attacker with PostgreSQL access to escalate privileges to superuser and execute arbitrary OS commands. The metrics exporter's session can be manipulated to recover superuser privileges, enabling the spawning of OS-level subprocesses. With a CVSS score of 9.9, this flaw poses an extremely high risk of full system compromise within the primary pod.
No public exploit is currently known for this vulnerability. The flaw is remotely exploitable (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L), making it a significant threat.
Upgrade CloudNativePG to version 1.29.1 or 1.28.3 or later to fix this privilege escalation vulnerability. Ensure that PostgreSQL connections are properly demoted and that session_user privileges cannot be easily recovered.
Technical Analysis
CVE-2026-44477 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.9.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (2)
Quick Facts
Related CVEs (CWE-250)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-44477 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts