CloudNativePG versions before 1.28.4, 1.29.2 and 1.30.0 embed cleartext role passwords in ALTER ROLE and CREATE ROLE statements. When pg_stat_statements is preloaded with track_utility, an untrusted tenant possessing pg_monitor or pg_read_all_stats can retrieve platform‑managed superuser or application‑owner passwords from query history and then use those credentials to re‑authenticate as a superuser via open TCP access or by executing COPY … FROM PROGRAM. This sequence results in arbitrary operating system command execution inside the database pod, compromising the confidentiality, integrity and availability of the cluster.

CloudNativePG platform; clusters using versions older than 1.28.4, 1.29.2 or 1.30.0 and employing role registration with plaintext secrets are affected. Versions using SCRAM‑SHA‑256 verifiers in managed-role Secrets are not impacted.

The CVSS score is 8.5, indicating high severity. EPSS data is not available, but the lack of KEV listing does not mitigate the risk because the vulnerability enables critical privilege escalation within a Kubernetes environment. The likely attack vector requires a tenant that can assign roles with pg_monitor or pg_read_all_stats privileges; once a password is recovered, the attacker can issue COPY … FROM PROGRAM commands to run arbitrary OS commands in the database pod.