Executive brief
CloudNativePG is a Kubernetes operator that automates PostgreSQL database management. Prior to patched versions, it embedded cleartext database passwords directly in SQL statements sent to PostgreSQL. When PostgreSQL's query logging extension was enabled, authenticated attackers with limited database privileges could extract superuser and application owner passwords from the logs, then use those credentials to gain superuser access and execute system commands within the database container.
Technical details
CloudNativePG embedded cleartext role passwords in CREATE ROLE and ALTER ROLE SQL statements generated in pkg/management/postgres/utils/roles.go and internal/management/controller/roles/postgres.go. When the pg_stat_statements extension was preloaded with track_utility enabled, an authenticated database tenant with pg_monitor or pg_read_all_stats role could query pg_stat_statements to recover plaintext superuser and application owner passwords. The attacker could then reconnect using the stolen credentials to execute arbitrary operating system commands via PostgreSQL's COPY...FROM PROGRAM feature. The fix (versions 1.28.4, 1.29.2, 1.30.0) now SCRAM-SHA-256 encodes passwords client-side before sending SQL statements, ensuring only the password hash is visible in query logs. Clusters already using SCRAM-SHA-256 password verifiers in managed-role Secrets were unaffected.
Affected products
- EDB CloudNativePG prior to 1.28.4, 1.29.2, and 1.30.0
Timeline
- 2026-08-20: disclosed
- 2026-05-27: patched: Fix committed; versions 1.28.4, 1.29.2, and 1.30.0 released