CVE-2026-55765 affects CloudNativePG, a platform for managing PostgreSQL databases in Kubernetes. Versions prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE SQL statements. If pg_stat_statements was preloaded with track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats privileges could recover superuser or application-owner passwords. With those credentials, the attacker could reconnect via superuser TCP access and execute OS-level commands inside the database pod using COPY ... FROM PROGRAM. Clusters using SCRAM-SHA-256 verifiers were not affected by this vulnerability. The issue has been remediated in versions 1.28.4, 1.29.2, and 1.30.0.
