Cloudnative-pg vulnerabilities
We track 3 vulnerabilities in Cloudnative-pg products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Cloudnative-pg vulnerabilities
- 9.4 Critical severity
cloudnative-pg: Untrusted Search Path
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/prof
- 8.5 High severity
cloudnative-pg: Plaintext Storage of a Password
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/man
- 9.9 Critical severity
cloudnative-pg: Execution with Unnecessary Privileges
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then dem