Riskcovery

CVE-2026-104055

Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

State
Published
Severity
5.3 Medium
Published
Oct 2, 2026
Updated
Oct 3, 2026
Reserved
Oct 1, 2026

Read the record on cve.org

Description

The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:Ncanonical

Weaknesses

  • CWE-532 Insertion of sensitive information into log file

Affected Products

ProductVersions
postgresql-operatorCanonical
  • before 1189Affected
  • before 1190Affected
  • before 1216Affected
  • before 1217Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.