Executive brief
CloudNativePG is a Kubernetes-native platform that manages PostgreSQL database clusters. A database owner can exploit a search_path flaw to execute arbitrary code as the PostgreSQL superuser, potentially compromising the entire database and accessing sensitive pod credentials used for cloud authentication.
Technical details
The vulnerability is a privilege escalation resulting from insufficient search_path pinning in PostgreSQL connection handling (CWE-426, similar to CVE-2018-1058). A database owner can plant overloaded built-in operators (=, >, etc.) in the public schema, then modify database or role search_path settings to cause instance-manager introspection queries to resolve these attacker-controlled operators before pg_catalog. This allows arbitrary function execution as the superuser. The attack is feasible because superuser connections in pkg/management/postgres/pool/profiles.go did not pin search_path, and direct sql.Open() calls plus the public.user_search SECURITY DEFINER function were similarly unprotected. An attacker can then use COPY ... FROM PROGRAM to execute OS commands and read pod ServiceAccount tokens. Patches are available in versions 1.28.4, 1.29.2, and 1.30.0, which pin search_path = pg_catalog, public, pg_temp on all pooled connections and user-facing paths.
Affected products
- CloudNative CloudNativePG before 1.28.4, before 1.29.2
Timeline
- 2026-08-20: disclosed
- 2026-06-09: patched: Fix committed; versions 1.28.4, 1.29.2, and 1.30.0 include the patch