StackGres CVE-2026-78155

Exploitation requires the attacker to already hold a low-privilege tenant account that owns a database managed by the StackGres operator (PR:L, authenticated) and network reachability to the operator/API (AV:N); no user interaction and no elevated privileges beyond database ownership are needed (AC:L, UI:N). The primary limiting factor is that the attacker must be a provisioned tenant with database-owner rights, so deployments that are single-tenant, or where all database owners are trusted operators, are not realistically exposed. The scope change (S:C) means success grants privileges beyond the tenant's original security authority - full administrator control of the platform.

Signals are mostly aligned toward high priority but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change and full CIA impact - consistent with a tenant fully compromising the platform. However, EPSS is not provided, the vulnerability is not in CISA KEV (so no confirmed active exploitation), and no POC is referenced, so the practical exploitation likelihood is unquantified. The high CVSS is driven by the scope change and privilege gain rather than by evidence of in-the-wild use, so this is best treated as a high-severity latent risk in multi-tenant StackGres deployments rather than a confirmed under-attack emergency. A key caveat: PR:L implies an authenticated attacker (a legitimate tenant), so environments running StackGres single-tenant or with only trusted operators face materially lower real-world risk than shared/multi-tenant clusters.

A malicious or compromised tenant who legitimately owns a database within a shared StackGres deployment abuses the operator's flawed privilege handling to escalate from database-owner to platform administrator. With administrator control the attacker can read, alter, or destroy other tenants' databases and manipulate the operator itself. The low attack complexity and lack of required user interaction make exploitation straightforward for any account with the needed tenant privilege, though no public exploit code is currently known.