A high-severity credential exposure vulnerability in CloudNativePG allows authenticated users to potentially access sensitive database passwords stored in plaintext.

This vulnerability involves the plaintext storage of passwords (CWE-256) and insufficient protection of credentials (CWE-522). The flaw requires low privileges to access the environment where these credentials are exposed.

With a CVSS score of 8.5, this vulnerability represents a significant risk to data confidentiality. If exploited, an attacker with low-level access could gain unauthorized administrative control over managed PostgreSQL databases, leading to data exfiltration or massive data loss.

Immediate Action: Upgrade to CloudNativePG version 1.28.4, 1.29.2, or 1.30.0 immediately to resolve the credential storage issue.

Proactive Monitoring: Audit Kubernetes secrets and logs for any suspicious access patterns or unauthorized attempts to read credential objects.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) within your Kubernetes cluster to minimize the number of users who can interact with sensitive secret objects.

Public Exploit Available: No

Security teams should treat this as a high-priority update to ensure that database credentials remain protected. Update your CloudNativePG deployment and rotate any credentials that may have been stored in an insecure manner prior to the patch.