-
Notifications
You must be signed in to change notification settings - Fork 40
docs: announcement for 1.29.1 and 1.28.3 #445
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
+150
−0
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Binary file added
BIN
+442 KB
...eleases/cloudnative-pg-1-29.1-released/58364dde1adc4a0a8.37186404-2048x1445.jpg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
150 changes: 150 additions & 0 deletions
150
content/releases/cloudnative-pg-1-29.1-released/index.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,150 @@ | ||
| --- | ||
| title: "CloudNativePG 1.29.1 and 1.28.3 released: critical CVE fix" | ||
| date: 2026-05-08 | ||
| draft: false | ||
| authors: | ||
| - gbartolini | ||
| image: | ||
| url: 58364dde1adc4a0a8.37186404-2048x1445.jpg | ||
| attribution: from <a href="https://wordpress.org/photos/photo/58364dde1a/">Saurabh</a> | ||
| tags: | ||
| - release | ||
| - postgresql | ||
| - postgres | ||
| - kubernetes | ||
| - k8s | ||
| - cloudnativepg | ||
| - cnpg | ||
| - security | ||
| - cve | ||
| - high-availability | ||
| summary: "CloudNativePG 1.29.1 and 1.28.3 are now available. These releases address CVE-2026-44477 (Critical, CVSS 9.4) in the metrics exporter, remediate additional CVEs in pgx and the Go runtime, and ship important HA fixes including a data-safety bug in the failover path. All users should upgrade immediately." | ||
| --- | ||
|
|
||
| The CloudNativePG community is releasing **maintenance updates for all | ||
| currently supported series**: **1.29.1** and **1.28.3**. | ||
|
|
||
| This is a high-priority release. It addresses **[CVE-2026-44477](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-423p-g724-fr39)** | ||
| (the first CVE officially assigned against CloudNativePG, rated **Critical** | ||
| with a CVSS v4 score of **9.4**), alongside additional CVE remediations in | ||
| dependencies and the Go runtime. | ||
|
|
||
| On the reliability side, three independent bugs in the HA failover path are | ||
| resolved, including a label retention issue that could route writes to a former | ||
| primary during a network partition | ||
| ([#10409](https://github.com/cloudnative-pg/cloudnative-pg/pull/10409)), a | ||
| condition that prevented failover from triggering when a node became | ||
| unreachable | ||
| ([#10448](https://github.com/cloudnative-pg/cloudnative-pg/pull/10448)), and a | ||
| guard against spurious failovers from transient HTTP endpoint failures | ||
| ([#10445](https://github.com/cloudnative-pg/cloudnative-pg/pull/10445)). Both | ||
| releases also include a number of correctness and robustness fixes. See the | ||
| release notes for the full list. | ||
|
|
||
| **All users should upgrade immediately.** | ||
|
|
||
| --- | ||
|
|
||
| ## Security | ||
|
|
||
| ### CVE-2026-44477: metrics exporter privilege escalation and OS RCE | ||
|
|
||
| The metrics exporter previously opened its PostgreSQL connection as the | ||
| `postgres` superuser and demoted the session with `SET ROLE pg_monitor`. That | ||
| demotion is insufficient: `session_user` remains `postgres`, and any SQL | ||
| evaluated inside the scrape session can call `RESET ROLE` to recover full | ||
| superuser privileges, then use `COPY ... TO PROGRAM` to spawn an arbitrary OS | ||
| process inside the primary pod. | ||
|
|
||
| Two independent paths exploit this root cause. The first requires a custom | ||
| metric query with an unqualified relation or function reference; the attack | ||
| completes within one scrape interval (≤ 30 s). The second requires no custom | ||
| metrics at all: the shipped `pg_extensions` metric was sufficient to let the | ||
| default `app` role (created automatically by `bootstrap.initdb`) trigger | ||
| the full escalation chain on a completely stock deployment. The combined impact | ||
| is superuser privilege escalation plus arbitrary OS command execution inside | ||
| the primary pod from a low-privileged database role. | ||
|
|
||
| The fix introduces a dedicated `cnpg_metrics_exporter` PostgreSQL role with | ||
| `pg_monitor` privileges only, mapped via `pg_ident.conf` peer authentication | ||
| (the same pattern used for `cnpg_pooler_pgbouncer`). The exporter now connects | ||
| as this role, so `RESET ROLE` has no escalation effect. All shipped monitoring | ||
| queries have also been hardened with explicit `pg_catalog.` qualification | ||
| ([#10576](https://github.com/cloudnative-pg/cloudnative-pg/pull/10576)). | ||
|
|
||
| For the full technical analysis, exploitation paths, workarounds and upgrade | ||
| impact, refer to the | ||
| [security advisory](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-423p-g724-fr39). | ||
|
|
||
| ### Additional CVE remediations | ||
|
|
||
| These releases also pick up: | ||
|
|
||
| - **`github.com/jackc/pgx/v5` v5.9.2**: fixes `CVE-2026-33816` | ||
| (memory-safety in `pgproto3`) and `GHSA-j88v-2chj-qfwx` (SQL injection via | ||
| dollar-quoted string handling in the simple protocol). | ||
|
|
||
| - **Go 1.26.3 runtime**: fixes across `crypto/x509`, `crypto/tls`, | ||
| `net/http`, and `net` (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, | ||
| CVE-2026-33811, CVE-2026-33814, CVE-2026-39825), plus CVE-2026-42501 in | ||
| `cmd/go` module-checksum validation during release builds. | ||
|
|
||
| - **Discoverable SBOM and provenance attestations** | ||
| ([#10601](https://github.com/cloudnative-pg/cloudnative-pg/pull/10601)): | ||
| attestations attached to operator images now follow the OCI 1.1 Referrers | ||
| spec, making them automatically discoverable by standard registry tooling and | ||
| supply-chain scanners. | ||
|
|
||
| --- | ||
|
|
||
| ## Acknowledgement | ||
|
|
||
| We thank **Mehmet Ince** ([@mdisec](https://github.com/mdisec)) for | ||
|
gbartolini marked this conversation as resolved.
|
||
| responsibly disclosing CVE-2026-44477, providing a thorough analysis of both | ||
| exploitation paths and a working proof of concept. | ||
|
|
||
| --- | ||
|
|
||
| ## Upgrade | ||
|
|
||
| Follow the upgrade instructions specific to your series: | ||
|
|
||
| - **1.29.x → 1.29.1:** [upgrade guide](https://cloudnative-pg.io/docs/1.29/installation_upgrade#upgrading-to-1291-or-1283) | ||
| - **1.28.x → 1.28.3:** [upgrade guide](https://cloudnative-pg.io/docs/1.28/installation_upgrade#upgrading-to-1291-or-1283) | ||
|
|
||
| For deployments with replica clusters, upgrade the source primary cluster | ||
| first. See the [security advisory](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-423p-g724-fr39) | ||
| for sequencing details. | ||
|
|
||
| For the complete list of changes, see the release notes: | ||
|
|
||
| - [Release notes for 1.29.1](https://cloudnative-pg.io/docs/1.29/release_notes/v1.29/#version-1291) | ||
| - [Release notes for 1.28.3](https://cloudnative-pg.io/docs/1.28/release_notes/v1.28/#version-1283) | ||
|
|
||
| --- | ||
|
|
||
| ## Get Involved with the Community | ||
|
|
||
| [Join us](https://github.com/cloudnative-pg/cloudnative-pg?tab=readme-ov-file#communications) | ||
| to help shape the future of cloud-native Postgres! | ||
|
|
||
| If you're using CloudNativePG in production, consider | ||
| [adding your organization as an adopter](https://github.com/cloudnative-pg/cloudnative-pg/blob/main/ADOPTERS.md) | ||
| to support the project's growth and evolution. | ||
|
|
||
| Thank you for your continued support! | ||
|
|
||
| <!-- | ||
|
mnencia marked this conversation as resolved.
|
||
| ## About CloudNativePG | ||
|
|
||
| [CloudNativePG](https://cloudnative-pg.io) is an open-source Kubernetes | ||
| Operator specifically designed for PostgreSQL workloads. It manages the entire | ||
| lifecycle of a PostgreSQL cluster, including bootstrapping, configuration, high | ||
| availability, connection routing, and comprehensive backup and disaster | ||
| recovery mechanisms. By leveraging PostgreSQL's native streaming replication, | ||
| CloudNativePG efficiently distributes data across pods, nodes, and zones using | ||
| standard Kubernetes patterns, enabling seamless scaling of replicas in a | ||
| Kubernetes-native manner. Originally developed and supported by | ||
| [EDB](https://www.enterprisedb.com/), CloudNativePG is a CNCF Sandbox project | ||
| and the sole PostgreSQL operator in this category. | ||
| --> | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are you backdating this?
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, unfortunately, it should have been sent the same day (I was on PTO and could not help). These kinds of announcements should always be the ones linked on social media and in public references. It is too late for that, but at least it makes sense to do it retroactively.