CVE-2026-44477

[CVE catalog]

Severity

Critical · CVSS 9.4

Published

May 28, 2026, 3:46:12 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.48% · Oct 25, 2026

A flaw was found in CloudNativePG's metrics exporter. The issue arises because the metrics exporter connected to PostgreSQL using a highly privileged account and did not properly restrict privileges during monitoring operations. A low-privileged database user could exploit this behavior through crafted monitoring queries or PostgreSQL object resolution manipulation to regain PostgreSQL superuser privileges and potentially execute arbitrary operating system commands as the postgres user inside the affected database pod. github.com/cloudnative-pg/cloudnative-pg: CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE This vulnerability affects CloudNativePG's monitoring and metrics export functionality. The attacker may exploit the affected monitoring functionality to escalate privileges within the PostgreSQL environment and potentially execute arbitrary operating system commands as the postgres user inside the affected database pod. Red Hat Product Security has rated this issue as an Important severity vulnerability rather than Critical. A successful exploitation requires access to a valid database account. A low-privileged authenticated database user (PR:L) is needed. Although exploitation may result in PostgreSQL superuser access and command execution within the affected pod, the impact remains limited to the affected PostgreSQL and container environment. It does not lead to container escape, Kubernetes cluster compromise, or host level privilege escalation. Therefore, Scope is assessed as Unchanged (S:U). Because successful exploitation may allow disclosure, modification, or disruption of database contents, as well as arbitrary command execution within the affected pod, Red Hat assessed the Confidentiality, Integrity, and Availability impacts as High (C:H/I:H/A:H). The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.