CVE-2026-104055: PostgreSQL Operator Information Disclosure

CVE-2026-104055 Overview

CVE-2026-104055 affects the Canonical postgresql-operator charm, which deploys a Prometheus postgres_exporter to collect database metrics. The exporter authenticates as a dedicated monitoring PostgreSQL user. When the exporter encounters database connection errors, it writes the monitoring user's password in cleartext to its log output. Any actor with read access to those logs can recover the credential and obtain read-only pg_monitor access to the PostgreSQL database. The issue is classified as insertion of sensitive information into log files [CWE-532].

Critical Impact
Exposure of the monitoring user password through exporter error logs grants unauthenticated log readers read-only pg_monitor access to PostgreSQL databases managed by the charm.

Affected Products

Canonical postgresql-operator charm (14/edge) prior to revisions 1189 (arm64) and 1190 (amd64)
Canonical postgresql-operator charm (14/stable) prior to revisions 1216 (arm64) and 1217 (amd64)
Associated charmed-postgresql-snap builds bundling the vulnerable postgres_exporter behavior

Discovery Timeline

2026-10-02 - CVE-2026-104055 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104055

Vulnerability Analysis

The postgresql-operator charm bundles a Prometheus postgres_exporter configured to scrape metrics from the local PostgreSQL instance. The exporter authenticates with a dedicated monitoring role that holds pg_monitor privileges. When the exporter cannot establish a database connection, it emits a diagnostic log entry that includes the full connection string. That connection string contains the password for the monitoring user in cleartext.

The account only holds read-only observability privileges, so the direct impact is limited to information disclosure of database metrics, replication state, and query statistics. However, exposure of a valid PostgreSQL credential can enable further reconnaissance against the database tier and support lateral movement when combined with other weaknesses.

Root Cause

The root cause is insertion of sensitive information into log files [CWE-532]. The exporter's error handling path does not sanitize the connection URI before writing it to logs. Credential material embedded in the connection string is treated as ordinary diagnostic data and persisted to disk or forwarded to any log aggregation pipeline configured on the unit.

Attack Vector

Exploitation requires an actor to have read access to the exporter logs on the charm unit or to any downstream system that ingests them. This includes Juju operators with debug-log privileges, administrators of centralized logging platforms, and local accounts with filesystem access to the snap's log directory. After reading the cleartext password, the attacker can authenticate directly to PostgreSQL over the network as the monitoring user and issue read-only queries permitted by the pg_monitor role.

No exploitation code is required. The vulnerability is triggered by any condition that causes the exporter to fail a database connection, after which the password appears in the resulting log line. See the GitHub Security Advisory GHSA-rcx7-7rh5-r542 for upstream analysis.

Detection Methods for CVE-2026-104055

Indicators of Compromise

Log entries from postgres_exporter on the charm unit containing a PostgreSQL connection URI with an embedded password= parameter.
Successful authentications to PostgreSQL as the monitoring user originating from unexpected source addresses or outside normal exporter scrape windows.
Unexpected read-only queries against pg_stat_* views or other pg_monitor-scoped objects from clients other than the exporter.

Detection Strategies

Grep historical and current exporter logs for strings matching password= or full postgresql:// URIs and treat any match as a credential exposure event.
Correlate PostgreSQL log_connections events for the monitoring role against the known exporter host to flag anomalous sessions.
Audit log forwarding pipelines (for example Loki, Elasticsearch, or syslog collectors) for cached copies of exporter error entries containing credentials.

Monitoring Recommendations

Enable PostgreSQL connection and authentication logging and alert on monitoring user logins from non-exporter source IPs.
Monitor filesystem and object-store locations that retain historical charm logs and restrict access to privileged administrators.
Track charm revision inventory to confirm all units run patched revisions on both amd64 and arm64 architectures.

How to Mitigate CVE-2026-104055

Immediate Actions Required

Refresh the charm to a fixed revision: 1216 (arm64) or 1217 (amd64) on the 14/stable track, or 1189 (arm64) / 1190 (amd64) on 14/edge.
Rotate the monitoring PostgreSQL user password immediately after upgrade, since prior logs may already contain the credential.
Purge or restrict access to historical exporter logs on units and in any downstream log aggregation system.

Patch Information

Canonical fixed the issue in the postgresql-operator charm 14/edge track at revisions 1189 (arm64) and 1190 (amd64), and in the 14/stable track at revisions 1216 (arm64) and 1217 (amd64). The underlying changes are tracked in postgresql-operator pull request #1863, charmed-postgresql-snap pull request #305, and charmed-postgresql-snap pull request #307.

Workarounds

Restrict read access to exporter logs on charm units to a minimal set of operators until patched revisions are deployed.
Configure log forwarding and aggregation systems to redact password= fields and PostgreSQL connection URIs before storage.
Enforce network-level restrictions so that only the exporter host can reach the PostgreSQL port, limiting usefulness of a recovered credential.

bash

# Upgrade the charm to a fixed revision (example for 14/stable, amd64)
juju refresh postgresql --channel=14/stable --revision=1217

# Rotate the monitoring user password inside PostgreSQL
psql -U postgres -c "ALTER USER monitoring WITH PASSWORD '<new-strong-password>';"