The CloudNativePG metrics exporter opens a PostgreSQL connection as the postgres superuser and then demotes the session using SET ROLE pg_monitor. The demotion changes only the current_user while session_user remains postgres, allowing an attacker to execute SET ROLE to regain full superuser privileges and then run COPY … TO PROGRAM to spawn an OS‑level subprocess as the postgres user. This grants database and operating‑system control and is effectively a privilege escalation to PostgreSQL superuser and OS remote code execution. The flaw involves improper authorization handling (CWE‑250, CWE‑271) and unsafe use of system commands within SQL (CWE‑426).

The vulnerability affects CloudNativePG deployments running versions prior to 1.29.1 and 1.28.3. Any Kubernetes environment using the cloudnative‑pg:cloudnative‑pg platform with those legacy releases is subject to the issue. The affected component is the metrics exporter that is enabled by default in these releases.

The CVSS score of 9.4 indicates critical severity. No EPSS score is available, so the likelihood of exploitation remains uncertain but the lack of mitigation in builds before the fix means an attacker could exploit the path with a crafted metrics request if exposed. The vulnerability is not listed in CISA KEV, but the combination of superuser privilege and OS RCE makes it a high‑risk issue for environments that expose the metrics endpoint or allow local container access. The attack vector is likely local within the Kubernetes cluster, but if the metrics endpoint is exposed to external users, remote exploitation is possible.