CVE-2026-104055

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104055
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104055.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104055
Aliases
  • GHSA-rcx7-7rh5-r542
Published
2026-10-02T20:35:50Z
Modified
2026-10-04T02:45:58Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm
Details

The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).

Database specific 
{
    "cna_assigner":  "canonical",
    "cwe_ids":  [
        "CWE-532"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104055.json"
}
References

Affected packages

Git / github.com/canonical/postgresql-operator

Affected ranges

Type
GIT
Repo
https://github.com/canonical/postgresql-operator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d4c920944bb8d2776821650ad2c277d7f5bb687c
Fixed
c9910b32b0472c6875364dcea807613063d24e08
Fixed
4d14e0ff8301ae2db597fca947e8aa0e9dd79151
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1189"
        },
        {
            "fixed":  "1190"
        },
        {
            "fixed":  "1216"
        },
        {
            "fixed":  "1217"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
rev1000
rev1001
rev1002
rev1003
rev1004
rev1008
rev1009
rev1010
rev1011
rev1013
rev1015
rev1016
rev1017
rev1018
rev1019
rev1020
rev1021
rev1022
rev1023
rev1024
rev1025
rev1026
rev1027
rev1028
rev1029
rev1030
rev1031
rev1032
rev1033
rev1034
rev1035
rev1036
rev1037
rev1038
rev1039
rev1040
rev1041
rev1042
rev1043
rev1044
rev1045
rev1046
rev1047
rev1048
rev1049
rev1050
rev1051
rev1052
rev1053
rev1054
rev1055
rev1056
rev1057
rev1058
rev1059
rev1061
rev1062
rev1063
rev1064
rev1065
rev1066
rev1067
rev1068
rev1069
rev1070
rev1071
rev1072
rev1074
rev1075
rev1076
rev1077
rev1078
rev1079
rev1080
rev1081
rev1082
rev1083
rev1084
rev1085
rev1086
rev1087
rev1088
rev1089
rev1090
rev1091
rev1092
rev1093
rev1094
rev1095
rev1096
rev1097
rev1098
rev1099
rev1100
rev1101
rev1102
rev1103
rev1104
rev1105
rev1117
rev1118
rev1119
rev1120
rev1121
rev1122
rev1123
rev1124
rev1125
rev1126
rev1127
rev1128
rev1129
rev1130
rev1131
rev1132
rev1133
rev1134
rev1138
rev1139
rev1140
rev1142
rev1143
rev1144
rev1145
rev1146
rev1147
rev1148
rev1149
rev1150
rev1151
rev1152
rev1153
rev1154
rev1155
rev1156
rev1157
rev1158
rev1159
rev1160
rev1161
rev1162
rev1163
rev1164
rev1165
rev1166
rev1171
rev1172
rev1173
rev1174
rev1175
rev1177
rev1178
rev1179
rev1180
rev1181
rev1182
rev1185
rev1186
rev1187
rev1190
rev1191
rev1196
rev1197
rev1198
rev1199
rev1204
rev1205
rev1210
rev1211
rev1214
rev1215
rev243
rev244
rev245
rev247
rev248
rev249
rev250
rev251
rev252
rev253
rev254
rev255
rev257
rev258
rev259
rev260
rev261
rev262
rev263
rev264
rev265
rev266
rev267
rev268
rev271
rev272
rev273
rev274
rev275
rev276
rev277
rev278
rev279
rev280
rev281
rev283
rev284
rev285
rev286
rev287
rev288
rev289
rev291
rev292
rev293
rev294
rev295
rev296
rev297
rev298
rev299
rev300
rev301
rev302
rev303
rev304
rev305
rev306
rev307
rev308
rev309
rev310
rev311
rev312
rev313
rev314
rev315
rev317
rev318
rev319
rev320
rev321
rev322
rev323
rev324
rev325
rev326
rev327
rev328
rev329
rev330
rev331
rev332
rev333
rev334
rev335
rev336
rev337
rev338
rev339
rev340
rev346
rev347
rev348
rev349
rev350
rev351
rev354
rev355
rev356
rev357
rev358
rev359
rev360
rev361
rev363
rev364
rev365
rev367
rev368
rev369
rev370
rev371
rev372
rev376
rev378
rev380
rev382
rev384
rev386
rev389
rev391
rev393
rev396
rev399
rev401
rev403
rev405
rev407
rev409
rev411
rev413
rev416
rev418
rev420
rev422
rev424
rev426
rev428
rev429
rev430
rev432
rev434
rev436
rev438
rev440
rev442
rev444
rev445
rev446
rev449
rev450
rev451
rev452
rev453
rev454
rev455
rev456
rev457
rev458
rev459
rev460
rev461
rev462
rev463
rev464
rev465
rev466
rev467
rev468
rev469
rev470
rev471
rev472
rev473
rev474
rev475
rev476
rev477
rev478
rev479
rev480
rev481
rev482
rev484
rev485
rev486
rev487
rev490
rev491
rev492
rev493
rev494
rev495
rev496
rev497
rev498
rev499
rev500
rev501
rev502
rev503
rev505
rev506
rev507
rev508
rev511
rev512
rev513
rev514
rev515
rev516
rev517
rev518
rev519
rev520
rev521
rev522
rev528
rev529
rev530
rev531
rev532
rev533
rev534
rev535
rev536
rev537
rev538
rev539
rev540
rev541
rev542
rev543
rev544
rev545
rev546
rev547
rev548
rev549
rev550
rev551
rev552
rev553
rev554
rev555
rev556
rev557
rev558
rev559
rev560
rev561
rev562
rev563
rev564
rev565
rev566
rev567
rev568
rev570
rev571
rev572
rev573
rev574
rev575
rev576
rev577
rev578
rev579
rev580
rev581
rev582
rev583
rev584
rev587
rev588
rev589
rev590
rev592
rev593
rev594
rev595
rev596
rev597
rev598
rev599
rev600
rev601
rev602
rev603
rev605
rev606
rev607
rev608
rev609
rev610
rev612
rev613
rev615
rev616
rev701
rev702
rev705
rev706
rev707
rev708
rev734
rev735
rev740
rev741
rev742
rev743
rev753
rev754
rev755
rev756
rev757
rev758
rev763
rev764
rev766
rev767
rev768
rev769
rev770
rev771
rev772
rev773
rev775
rev776
rev777
rev778
rev779
rev780
rev782
rev783
rev784
rev785
rev786
rev787
rev788
rev789
rev790
rev791
rev792
rev793
rev796
rev797
rev798
rev799
rev800
rev801
rev802
rev803
rev804
rev805
rev806
rev807
rev809
rev810
rev817
rev818
rev819
rev820
rev821
rev822
rev823
rev824
rev830
rev831
rev832
rev833
rev836
rev837
rev841
rev842
rev843
rev844
rev847
rev848
rev855
rev856
rev857
rev858
rev859
rev860
rev861
rev862
rev863
rev864
rev865
rev866
rev867
rev868
rev871
rev872
rev873
rev874
rev875
rev876
rev877
rev878
rev879
rev880
rev881
rev882
rev883
rev884
rev885
rev886
rev889
rev890
rev891
rev892
rev893
rev894
rev895
rev896
rev897
rev898
rev899
rev900
rev901
rev902
rev903
rev904
rev905
rev906
rev907
rev908
rev909
rev910
rev911
rev912
rev913
rev914
rev915
rev916
rev917
rev918
rev919
rev920
rev921
rev922
rev923
rev924
rev925
rev926
rev927
rev928
rev929
rev930
rev931
rev932
rev933
rev934
rev935
rev936
rev937
rev938
rev939
rev940
rev941
rev942
rev943
rev944
rev945
rev946
rev949
rev950
rev951
rev952
rev953
rev954
rev957
rev958
rev959
rev960
rev961
rev962
rev963
rev964
rev965
rev966
rev968
rev969
rev970
rev971
rev972
rev973
rev974
rev975
rev976
rev977
rev978
rev979
rev980
rev981
rev982
rev983
rev984
rev985
rev986
rev987
rev989
rev990
rev991
rev992
rev993
rev994
rev997
rev998
rev999
v16/1.*
v16/1.0.0
v16/1.1.0
v16/1.10.0
v16/1.100.0
v16/1.101.0
v16/1.102.0
v16/1.103.0
v16/1.104.0
v16/1.105.0
v16/1.106.0
v16/1.107.0
v16/1.108.0
v16/1.109.0
v16/1.11.0
v16/1.110.0
v16/1.111.0
v16/1.112.0
v16/1.113.0
v16/1.114.0
v16/1.115.0
v16/1.116.0
v16/1.117.0
v16/1.118.0
v16/1.119.0
v16/1.12.0
v16/1.120.0
v16/1.121.0
v16/1.122.0
v16/1.123.0
v16/1.124.0
v16/1.125.0
v16/1.126.0
v16/1.127.0
v16/1.128.0
v16/1.129.0
v16/1.13.0
v16/1.130.0
v16/1.131.0
v16/1.132.0
v16/1.133.0
v16/1.134.0
v16/1.135.0
v16/1.136.0
v16/1.137.0
v16/1.138.0
v16/1.139.0
v16/1.14.0
v16/1.140.0
v16/1.141.0
v16/1.142.0
v16/1.143.0
v16/1.144.0
v16/1.145.0
v16/1.146.0
v16/1.147.0
v16/1.148.0
v16/1.149.0
v16/1.15.0
v16/1.150.0
v16/1.151.0
v16/1.152.0
v16/1.153.0
v16/1.154.0
v16/1.155.0
v16/1.156.0
v16/1.157.0
v16/1.158.0
v16/1.159.0
v16/1.16.0
v16/1.160.0
v16/1.161.0
v16/1.162.0
v16/1.163.0
v16/1.164.0
v16/1.165.0
v16/1.166.0
v16/1.167.0
v16/1.168.0
v16/1.169.0
v16/1.17.0
v16/1.170.0
v16/1.171.0
v16/1.172.0
v16/1.173.0
v16/1.174.0
v16/1.175.0
v16/1.176.0
v16/1.177.0
v16/1.178.0
v16/1.179.0
v16/1.18.0
v16/1.180.0
v16/1.181.0
v16/1.182.0
v16/1.183.0
v16/1.184.0
v16/1.185.0
v16/1.186.0
v16/1.187.0
v16/1.188.0
v16/1.189.0
v16/1.19.0
v16/1.190.0
v16/1.191.0
v16/1.192.0
v16/1.193.0
v16/1.194.0
v16/1.195.0
v16/1.196.0
v16/1.197.0
v16/1.198.0
v16/1.199.0
v16/1.2.0
v16/1.20.0
v16/1.200.0
v16/1.201.0
v16/1.202.0
v16/1.203.0
v16/1.204.0
v16/1.205.0
v16/1.206.0
v16/1.207.0
v16/1.208.0
v16/1.209.0
v16/1.21.0
v16/1.210.0
v16/1.211.0
v16/1.212.0
v16/1.213.0
v16/1.214.0
v16/1.215.0
v16/1.216.0
v16/1.217.0
v16/1.218.0
v16/1.219.0
v16/1.22.0
v16/1.220.0
v16/1.221.0
v16/1.222.0
v16/1.223.0
v16/1.224.0
v16/1.225.0
v16/1.226.0
v16/1.227.0
v16/1.228.0
v16/1.229.0
v16/1.23.0
v16/1.230.0
v16/1.231.0
v16/1.232.0
v16/1.233.0
v16/1.234.0
v16/1.235.0
v16/1.236.0
v16/1.237.0
v16/1.238.0
v16/1.239.0
v16/1.24.0
v16/1.240.0
v16/1.241.0
v16/1.242.0
v16/1.243.0
v16/1.244.0
v16/1.245.0
v16/1.246.0
v16/1.247.0
v16/1.248.0
v16/1.249.0
v16/1.25.0
v16/1.250.0
v16/1.251.0
v16/1.252.0
v16/1.253.0
v16/1.254.0
v16/1.255.0
v16/1.256.0
v16/1.257.0
v16/1.258.0
v16/1.259.0
v16/1.26.0
v16/1.260.0
v16/1.261.0
v16/1.262.0
v16/1.263.0
v16/1.264.0
v16/1.265.0
v16/1.266.0
v16/1.267.0
v16/1.268.0
v16/1.269.0
v16/1.27.0
v16/1.270.0
v16/1.271.0
v16/1.272.0
v16/1.273.0
v16/1.274.0
v16/1.275.0
v16/1.276.0
v16/1.277.0
v16/1.278.0
v16/1.279.0
v16/1.28.0
v16/1.280.0
v16/1.281.0
v16/1.282.0
v16/1.283.0
v16/1.284.0
v16/1.285.0
v16/1.286.0
v16/1.287.0
v16/1.288.0
v16/1.289.0
v16/1.29.0
v16/1.290.0
v16/1.291.0
v16/1.292.0
v16/1.293.0
v16/1.294.0
v16/1.295.0
v16/1.296.0
v16/1.297.0
v16/1.298.0
v16/1.299.0
v16/1.3.0
v16/1.30.0
v16/1.300.0
v16/1.301.0
v16/1.302.0
v16/1.303.0
v16/1.304.0
v16/1.305.0
v16/1.306.0
v16/1.307.0
v16/1.308.0
v16/1.309.0
v16/1.31.0
v16/1.310.0
v16/1.311.0
v16/1.312.0
v16/1.313.0
v16/1.314.0
v16/1.315.0
v16/1.316.0
v16/1.317.0
v16/1.318.0
v16/1.319.0
v16/1.32.0
v16/1.320.0
v16/1.321.0
v16/1.322.0
v16/1.323.0
v16/1.324.0
v16/1.325.0
v16/1.326.0
v16/1.327.0
v16/1.328.0
v16/1.329.0
v16/1.33.0
v16/1.330.0
v16/1.331.0
v16/1.332.0
v16/1.34.0
v16/1.35.0
v16/1.36.0
v16/1.37.0
v16/1.38.0
v16/1.39.0
v16/1.4.0
v16/1.40.0
v16/1.41.0
v16/1.42.0
v16/1.43.0
v16/1.44.0
v16/1.45.0
v16/1.46.0
v16/1.47.0
v16/1.48.0
v16/1.49.0
v16/1.5.0
v16/1.50.0
v16/1.51.0
v16/1.52.0
v16/1.53.0
v16/1.54.0
v16/1.55.0
v16/1.56.0
v16/1.57.0
v16/1.58.0
v16/1.59.0
v16/1.6.0
v16/1.60.0
v16/1.61.0
v16/1.62.0
v16/1.63.0
v16/1.64.0
v16/1.65.0
v16/1.66.0
v16/1.67.0
v16/1.68.0
v16/1.69.0
v16/1.7.0
v16/1.70.0
v16/1.71.0
v16/1.72.0
v16/1.73.0
v16/1.74.0
v16/1.75.0
v16/1.76.0
v16/1.77.0
v16/1.78.0
v16/1.79.0
v16/1.8.0
v16/1.80.0
v16/1.81.0
v16/1.82.0
v16/1.83.0
v16/1.84.0
v16/1.85.0
v16/1.86.0
v16/1.87.0
v16/1.88.0
v16/1.89.0
v16/1.9.0
v16/1.90.0
v16/1.91.0
v16/1.92.0
v16/1.93.0
v16/1.94.0
v16/1.95.0
v16/1.96.0
v16/1.97.0
v16/1.98.0
v16/1.99.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104055.json"