RATATOSKRATATOSK
Sign in

CloudNativePG

v1.28.3Storage & Data
May 8, 2026

ACTION 4CHECK 1OTHER 10

A security-focused maintenance release with dependency and Go runtime remediations. It also includes failover and configuration correctness fixes, including a monitoring-role migration and stricter validation that affect operator-visible behavior.

Action needed (4)

  • securitycriticalThe github.com/jackc/pgx/v5 dependency at v5.9.2

    The github.com/jackc/pgx/v5 dependency was bumped to v5.9.2 for upstream fixes addressing CVE-2026-33816 in pgproto3 and GHSA-j88v-2chj-qfwx involving SQL injection through simple-protocol dollar-quoted string handling.

  • securityhighGo runtime built with Go 1.26.3

    The Go runtime is built with Go 1.26.3 to include upstream fixes in crypto/x509, crypto/tls, net/http, and net. The build includes fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33814, CVE-2026-33811, and CVE-2026-39825.

  • securityhighcmd/go module-checksum validation

    The Go 1.26.3 update also addresses CVE-2026-42501, which concerns cmd/go module-checksum validation during release builds.

  • securityUnqualified reference resolution through search_path

    Unqualified references resolve through search_path, which a database user can manipulate to shadow built-in objects.

Check if affected (1)

  • securitycriticalMetrics exporter authentication and monitoring role

    Applies if the metrics exporter runs.

    The metrics exporter now uses the dedicated cnpg_metrics_exporter role with pg_monitor privileges instead of authenticating as the postgres superuser. This closes the privilege-escalation chain described by CVE-2026-44477 and GHSA-423p-g724-fr39.

All 10 other recorded changesfixes 8 · additions 1 · value changes 1

fixes (8)

  • Fixed a failover window where the former primary kept its primary label.
  • Fixed failover not being triggered when the node hosting the primary becomes unreachable.
  • Fixed spurious failovers caused by transient failures on the primary's HTTP status endpoint.
  • Fixed escaping of backslashes and control characters in PostgreSQL configuration values.
  • Fixed restore_command construction to shell-quote each argument.
  • Malformed values are rejected at admission instead of failing later during PostgreSQL recovery.
  • Fixed snapshot restores failing when leftover pgsql_tmp* directories were present in the data directory.
  • Fixed a deadlock occurring when PVC storage size and resource requests are changed simultaneously.

additions (1)

  • SBOM and SLSA provenance attached to operator container images now follow the OCI 1.1 Referrers spec, so standard registry tooling and supply-chain scanners can discover them automatically.

value changes (1)

  • Switched TLS peer verification from VerifyPeerCertificate to VerifyConnection, which runs on every completed handshake (the former is skipped on resumed TLS 1.3 sessions).
Add CloudNativePG to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All CloudNativePG releases →