CloudNativePG: a database owner escalates to PostgreSQL superuser and OS command execution in the pod

Impact

CloudNativePG's instance manager opened superuser connections without pinning search_path, so a role holding DATABASE OWNER could shadow built-in operators in the public schema and have its own functions executed as the postgres superuser by routine introspection queries. From superuser, the advisory names two further steps: OS command execution via COPY ... FROM PROGRAM inside the database pod, and access to the pod's ServiceAccount token. That token is the pivot that matters on a shared cluster - a tenant-owned database becomes a foothold in the Kubernetes control plane, and CloudNativePG commonly backs the metadata and job-tracking databases that a GPU scheduling stack depends on. The same trust issue affected direct pgx callsites and the public.user_search SECURITY DEFINER function.

Who can reach it

Any authenticated database role that holds DATABASE OWNER on a database managed by CloudNativePG. No cluster credentials or node access required - ordinary tenant database access is the entry point.

What to do

Upgrade CloudNativePG to 1.28.4, 1.29.2, or 1.30.0; the operator rolls the instance-manager containers, which means a switchover and brief primary interruption per cluster rather than any node maintenance. Review which roles hold DATABASE OWNER on managed clusters, and treat any cluster where an untrusted role held it as potentially having leaked its pod ServiceAccount token - rotate it.

References

Related entries

• CloudNativePG instance manager (PostgreSQL connection search_path): The owner of any managed database — a roleNCVD-2026-048-cloudnativepg-instance-manager-p · CloudNativePG instance manager (PostgreSQL connection search_path)Critical
• Pure Storage FlashBlade management interface authentication: An attacker authenticates to the FlashBlade managementCVE-2023-4976 · Pure Storage FlashBlade management interface authenticationCritical
• MinIO (admin IAM import API): The IAM import API can be driven to grant an attacker administrative policy, converting aCVE-2024-55949 · MinIO (admin IAM import API)Critical
• Renovate: shell metacharacters in helmv3 registryAliases give commit-access users command executionCVE-2024-58376 · Renovate (helmv3 manager, registryAliases handling)Critical
• Citrix NetScaler ADC and Gateway: unauthenticated remote compromise of the applianceCVE-2026-19490 · Citrix NetScaler ADC / GatewayCritical
• Backpropagate (single-GPU LLM fine-tuning library) - Reflex web UI: The optional web UI exposes a training controlCVE-2026-48797 · Backpropagate (single-GPU LLM fine-tuning library) - Reflex web UICritical