Cloudnative Pg
Monthly
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.