CVE-2026-104055

The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).

CVSS

No CVSS.

References

Link	Resource
https://github.com/canonical/charmed-postgresql-snap/pull/305
https://github.com/canonical/charmed-postgresql-snap/pull/307
https://github.com/canonical/postgresql-operator/pull/1863
https://github.com/canonical/postgresql-operator/security/advisories/GHSA-rcx7-7rh5-r542

Configurations

No configuration.

History

02 Oct 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-02 21:16

Updated : 2026-10-06 16:08

NVD link : CVE-2026-104055

Mitre link : CVE-2026-104055

CVE.ORG link : CVE-2026-104055

JSON object : View

Products Affected

No product.

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-104055", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104055", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-03T15:50:41.564616Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/postgresql-operator", "vendor": "Canonical", "product": "postgresql-operator", "versions": [{"status": "affected", "version": "0", "lessThan": "1189", "versionType": "charm-revision"}, {"status": "affected", "version": "0", "lessThan": "1190", "versionType": "charm-revision"}, {"status": "affected", "version": "0", "lessThan": "1216", "versionType": "charm-revision"}, {"status": "affected", "version": "0", "lessThan": "1217", "versionType": "charm-revision"}], "platforms": ["Linux"], "packageName": "charmed-postgresql", "collectionURL": "https://charmhub.io/postgresql", "defaultStatus": "unaffected"}]}], "published": "2026-10-02T21:16:54.607", "references": [{"url": "https://github.com/canonical/charmed-postgresql-snap/pull/305", "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/charmed-postgresql-snap/pull/307", "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/postgresql-operator/pull/1863", "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/postgresql-operator/security/advisories/GHSA-rcx7-7rh5-r542", "source": "security@ubuntu.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated \"monitoring\" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64)."}], "lastModified": "2026-10-06T16:08:27.613", "sourceIdentifier": "security@ubuntu.com"}