# CVE-2026-44477: CloudNativePG privilege escalation and RCE in metrics exporter

Source: https://junglewise.ai/threats/cve-2026-44477-cloudnativepg-privilege-escalation-and-rce-in-metrics-exporter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44477 · Severity: critical · CVSS 9.9 · Published 2026-05-28

CloudNativePG is an operator used to manage PostgreSQL database clusters within Kubernetes. A vulnerability in its monitoring component allows a low-privileged database user to escalate their privileges to a database superuser and execute arbitrary commands on the underlying operating system. This could lead to a complete takeover of the database pod and exposure of all hosted data.

Technologies: [CloudNativePG](https://junglewise.ai/threats/technologies/cloudnativepg). Vendors: [CloudNativePG](https://junglewise.ai/threats/vendors/cloudnativepg), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44477 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44477 being exploited in the wild.

**How severe is CVE-2026-44477?** Critical severity, with a CVSS score of 9.9, published 28 May 2026.

**Which products and versions are affected?** CloudNativePG < 1.28.3, >= 1.29.0, < 1.29.1; github.com/cloudnative-pg/cloudnative-pg (Go) SEMVER:introduced=0,fixed=1.28.3, SEMVER:introduced=0,fixed=1.28.3,introduced=1.29.0,fixed=1.29.1.

**Is there a fix for CVE-2026-44477?** Yes. github.com/cloudnative-pg/cloudnative-pg (Go): upgrade to 1.28.3, 1.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44477 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44477?** Check whether you run CloudNativePG or github.com/cloudnative-pg/cloudnative-pg (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cloudnative-pg/cloudnative-pg (Go): upgrade to 1.28.3, 1.29.1 or later

  ```sh
  go get github.com/cloudnative-pg/cloudnative-pg@v1.29.1
  ```


## Technical details

The CloudNativePG metrics exporter connects to PostgreSQL as the 'postgres' superuser but attempts to demote the session using 'SET ROLE'. Because 'session_user' remains 'postgres', any SQL expression evaluated during a scrape can invoke 'RESET ROLE' to regain superuser privileges. Attackers can exploit this by planting 'shadow' objects (functions or views) in a database that match unqualified identifiers used in monitoring queries (e.g., in default-monitoring.yaml). Once superuser status is regained, the attacker can use 'COPY ... TO PROGRAM' to achieve Remote Code Execution (RCE) as the 'postgres' user. The fix involves introducing a dedicated non-superuser role for the exporter and schema-qualifying all catalog references.

## Affected products

- CloudNativePG CloudNativePG < 1.28.3, >= 1.29.0, < 1.29.1

## Identifiers

- CVE-2026-44477
- GHSA-423p-g724-fr39
- GO-2026-5106

## Timeline

- 2026-05-08: disclosed
- 2026-05-11: advisory

## References

- [https://api.github.com/users/mdisec](https://api.github.com/users/mdisec)
- [https://github.com/mdisec](https://github.com/mdisec)
- [https://api.github.com/users/mdisec/gists%7B/gist_id%7D](https://api.github.com/users/mdisec/gists%7B/gist_id%7D)
- [https://api.github.com/users/mdisec/repos](https://api.github.com/users/mdisec/repos)
- [https://avatars.githubusercontent.com/u/4004716?v=4](https://avatars.githubusercontent.com/u/4004716?v=4)
- [https://api.github.com/users/mdisec/events%7B/privacy%7D](https://api.github.com/users/mdisec/events%7B/privacy%7D)