Is CVE-2026-44477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44477 being exploited in the wild.

How severe is CVE-2026-44477?

Critical severity, with a CVSS score of 9.9, published 28 May 2026.

Which products and versions are affected?

CloudNativePG = 1.29.0, < 1.29.1; github.com/cloudnative-pg/cloudnative-pg (Go) SEMVER:introduced=0,fixed=1.28.3, SEMVER:introduced=0,fixed=1.28.3,introduced=1.29.0,fixed=1.29.1.

Is there a fix for CVE-2026-44477?

Yes. github.com/cloudnative-pg/cloudnative-pg (Go): upgrade to 1.28.3, 1.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44477 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44477?

Check whether you run CloudNativePG or github.com/cloudnative-pg/cloudnative-pg (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44477: CloudNativePG privilege escalation and RCE in metrics exporter

Q: Is there a fix for CVE-2026-44477?

Yes. github.com/cloudnative-pg/cloudnative-pg (Go): upgrade to 1.28.3, 1.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44477 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44477?

Check whether you run CloudNativePG or github.com/cloudnative-pg/cloudnative-pg (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44477 · Severity: critical · CVSS 9.9 · Published 2026-05-28

CloudNativePG is an operator used to manage PostgreSQL database clusters within Kubernetes. A vulnerability in its monitoring component allows a low-privileged database user to escalate their privileges to a database superuser and execute arbitrary commands on the underlying operating system. This could lead to a complete takeover of the database pod and exposure of all hosted data.

Technologies: CloudNativePG. Vendors: CloudNativePG, Go.

Quick answers

Is CVE-2026-44477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44477 being exploited in the wild.
How severe is CVE-2026-44477?: Critical severity, with a CVSS score of 9.9, published 28 May 2026.
Which products and versions are affected?: CloudNativePG < 1.28.3, >= 1.29.0, < 1.29.1; github.com/cloudnative-pg/cloudnative-pg (Go) SEMVER:introduced=0,fixed=1.28.3, SEMVER:introduced=0,fixed=1.28.3,introduced=1.29.0,fixed=1.29.1.
Is there a fix for CVE-2026-44477?: Yes. github.com/cloudnative-pg/cloudnative-pg (Go): upgrade to 1.28.3, 1.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44477 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44477?: Check whether you run CloudNativePG or github.com/cloudnative-pg/cloudnative-pg (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/cloudnative-pg/cloudnative-pg (Go): upgrade to 1.28.3, 1.29.1 or later
```
go get github.com/cloudnative-pg/cloudnative-pg@v1.29.1
```

Technical details

The CloudNativePG metrics exporter connects to PostgreSQL as the 'postgres' superuser but attempts to demote the session using 'SET ROLE'. Because 'session_user' remains 'postgres', any SQL expression evaluated during a scrape can invoke 'RESET ROLE' to regain superuser privileges. Attackers can exploit this by planting 'shadow' objects (functions or views) in a database that match unqualified identifiers used in monitoring queries (e.g., in default-monitoring.yaml). Once superuser status is regained, the attacker can use 'COPY ... TO PROGRAM' to achieve Remote Code Execution (RCE) as the 'postgres' user. The fix involves introducing a dedicated non-superuser role for the exporter and schema-qualifying all catalog references.

Affected products

CloudNativePG CloudNativePG < 1.28.3, >= 1.29.0, < 1.29.1

Identifiers

CVE-2026-44477
GHSA-423p-g724-fr39
GO-2026-5106

Timeline

2026-05-08: disclosed
2026-05-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.