CVE-2026-44477: cloudnative-pg Execution with Unnecessary Privileges

Vulnerability summary

CVE-2026-44477 is a critical (CVSS 9.9) Execution with Unnecessary Privileges vulnerability in cloudnative-pg. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.6% of scored vulnerabilities.

Timeline

1. 28-05-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.

• CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
• CWE-271Privilege Dropping / Lowering ErrorsThe product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
• CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.