CVE catalog

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network ca

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 25, 2026

A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianprometheus-postgres-exportersid0.19.1-1unknown
Debianprometheus-postgres-exporterforky0.19.1-1unknown
Debianprometheus-postgres-exportertrixie0.17.1-1unknown
Debianprometheus-postgres-exporterbookworm0.11.1-3unknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianprometheus-postgres-exportersourcesid(unfixed)not yet assignedNot reportedNot reported
Debianprometheus-postgres-exportersourceforky(unfixed)not yet assignedNot reportedNot reported
Debianprometheus-postgres-exportersourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianprometheus-postgres-exportersourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [prometheus-postgres-exporter]Affected

    Source package: [prometheus-postgres-exporter]

    Details (2)

    • 0.11.1-3+b5 · amd64 · bookworm

      Affected

      nvd · prometheus-postgres-exporter · debian · bookworm; nvd · prometheus-postgres-exporter · debian · 12

    • 0.11.1-3+b5 · arm64 · bookworm

      Affected

      nvd · prometheus-postgres-exporter · debian · bookworm; nvd · prometheus-postgres-exporter · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]