https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:28:44 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-104055 <p>The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated &#34;monitoring&#34; PostgreSQL user. On database connection errors, the exporter writes the monitoring user&#39;s password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).</p> <p>The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated &#34;monitoring&#34; PostgreSQL user. On database connection errors, the exporter writes the monitoring user&#39;s password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-104055 https://vulnerability.circl.lu/vuln/ghsa-3533-w4pf-7x2r <p>The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated &#34;monitoring&#34; PostgreSQL user. On database connection errors, the exporter writes the monitoring user&#39;s password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).</p> <p>The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated &#34;monitoring&#34; PostgreSQL user. On database connection errors, the exporter writes the monitoring user&#39;s password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).</p> https://vulnerability.circl.lu/vuln/ghsa-3533-w4pf-7x2r