# CVE-2026-55769: CloudNativePG privilege escalation via search_path manipulation

Source: https://junglewise.ai/threats/cve-2026-55769-cloudnativepg-privilege-escalation-via-search-path-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55769 · Severity: info · CVSS 8.8 · Published 2026-08-20

CloudNativePG is a Kubernetes-native platform that manages PostgreSQL database clusters. A database owner can exploit a search_path flaw to execute arbitrary code as the PostgreSQL superuser, potentially compromising the entire database and accessing sensitive pod credentials used for cloud authentication.

## Quick answers

**Is CVE-2026-55769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55769 being exploited in the wild.

**How severe is CVE-2026-55769?** Informational severity, with a CVSS score of 8.8, published 20 August 2026.

**Which products and versions are affected?** CloudNative CloudNativePG before 1.28.4, before 1.29.2.

**Is there a fix for CVE-2026-55769?** A patch was published on 2026-06-09: Fix committed; versions 1.28.4, 1.29.2, and 1.30.0 include the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55769 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55769?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation resulting from insufficient search_path pinning in PostgreSQL connection handling (CWE-426, similar to CVE-2018-1058). A database owner can plant overloaded built-in operators (=, >, etc.) in the public schema, then modify database or role search_path settings to cause instance-manager introspection queries to resolve these attacker-controlled operators before pg_catalog. This allows arbitrary function execution as the superuser. The attack is feasible because superuser connections in pkg/management/postgres/pool/profiles.go did not pin search_path, and direct sql.Open() calls plus the public.user_search SECURITY DEFINER function were similarly unprotected. An attacker can then use COPY ... FROM PROGRAM to execute OS commands and read pod ServiceAccount tokens. Patches are available in versions 1.28.4, 1.29.2, and 1.30.0, which pin search_path = pg_catalog, public, pg_temp on all pooled connections and user-facing paths.

## Affected products

- CloudNative CloudNativePG before 1.28.4, before 1.29.2

## Timeline

- 2026-08-20: disclosed
- 2026-06-09: patched: Fix committed; versions 1.28.4, 1.29.2, and 1.30.0 include the patch

## References

- [https://github.com/cloudnative-pg/cloudnative-pg/commit/02b5c6289b7609dc87fcb1ae9c113160e3d43308](https://github.com/cloudnative-pg/cloudnative-pg/commit/02b5c6289b7609dc87fcb1ae9c113160e3d43308)
- [https://github.com/cloudnative-pg/cloudnative-pg/commit/db38f4d80315c8f1b21bf511ef0f28871820c14d](https://github.com/cloudnative-pg/cloudnative-pg/commit/db38f4d80315c8f1b21bf511ef0f28871820c14d)