Is CVE-2026-55765 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55765 being exploited in the wild.

How severe is CVE-2026-55765?

High severity, with a CVSS score of 8.5, published 20 August 2026.

Which products and versions are affected?

EDB CloudNativePG prior to 1.28.4, 1.29.2, and 1.30.0.

Is there a fix for CVE-2026-55765?

A patch was published on 2026-05-27: Fix committed; versions 1.28.4, 1.29.2, and 1.30.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55765 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55765?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55765: CloudNativePG cleartext password exposure via pg_stat_statements

CVE-2026-55765 · Severity: high · CVSS 8.5 · Published 2026-08-20

CloudNativePG is a Kubernetes operator that automates PostgreSQL database management. Prior to patched versions, it embedded cleartext database passwords directly in SQL statements sent to PostgreSQL. When PostgreSQL's query logging extension was enabled, authenticated attackers with limited database privileges could extract superuser and application owner passwords from the logs, then use those credentials to gain superuser access and execute system commands within the database container.

Quick answers

Is CVE-2026-55765 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55765 being exploited in the wild.
How severe is CVE-2026-55765?: High severity, with a CVSS score of 8.5, published 20 August 2026.
Which products and versions are affected?: EDB CloudNativePG prior to 1.28.4, 1.29.2, and 1.30.0.
Is there a fix for CVE-2026-55765?: A patch was published on 2026-05-27: Fix committed; versions 1.28.4, 1.29.2, and 1.30.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55765 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55765?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CloudNativePG embedded cleartext role passwords in CREATE ROLE and ALTER ROLE SQL statements generated in pkg/management/postgres/utils/roles.go and internal/management/controller/roles/postgres.go. When the pg_stat_statements extension was preloaded with track_utility enabled, an authenticated database tenant with pg_monitor or pg_read_all_stats role could query pg_stat_statements to recover plaintext superuser and application owner passwords. The attacker could then reconnect using the stolen credentials to execute arbitrary operating system commands via PostgreSQL's COPY...FROM PROGRAM feature. The fix (versions 1.28.4, 1.29.2, 1.30.0) now SCRAM-SHA-256 encodes passwords client-side before sending SQL statements, ensuring only the password hash is visible in query logs. Clusters already using SCRAM-SHA-256 password verifiers in managed-role Secrets were unaffected.

Affected products

EDB CloudNativePG prior to 1.28.4, 1.29.2, and 1.30.0

Timeline

2026-08-20: disclosed
2026-05-27: patched: Fix committed; versions 1.28.4, 1.29.2, and 1.30.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.