All vulnerabilities
CVE-2026-104055GHSA-rcx7-7rh5-r542

postgresql-operator: Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

Canonical postgresql-operatorDatabases
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1189Also 1190, 1216 and 1 moreCVE List
Published2 Oct 2026Updated 3 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).

Text from CVE List

Affected versions 4

  • postgresql-operatoraffected: all versions before 1189CVE List
  • postgresql-operatoraffected: all versions before 1190CVE List
  • postgresql-operatoraffected: all versions before 1216CVE List
  • postgresql-operatoraffected: all versions before 1217CVE List

References 4