RATATOSKRATATOSK
Sign in

CloudNativePG

v1.29.1Storage & Data
May 8, 2026

ACTION 5CHECK 1OTHER 10

A security-focused maintenance release reduces exporter privileges and updates Go and `pgx` components for upstream security fixes. It also includes failover and configuration correctness fixes, supply-chain metadata improvements, and monitoring changes that may require explicit grants or ordered upgrades.

Action needed (5)

  • securitycriticalThe metrics exporter authentication role

    The metrics exporter no longer authenticates as the postgres superuser. This release uses the dedicated cnpg_metrics_exporter role with only pg_monitor privileges, addressing CVE-2026-44477 and GHSA-423p-g724-fr39.

  • securitycriticalgithub.com/jackc/pgx/v5 at v5.9.2

    This release updates github.com/jackc/pgx/v5 to v5.9.2 for upstream fixes addressing CVE-2026-33816 in pgproto3 and GHSA-j88v-2chj-qfwx in simple-protocol dollar-quoted string handling.

  • securityhighGo 1.26.3 runtime library fixes

    The release is built with Go 1.26.3 for upstream fixes in crypto/x509, crypto/tls, net/http, and net. The update addresses CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, and CVE-2026-39825.

  • securityhighcmd/go module-checksum validation

    The Go 1.26.3 update also addresses CVE-2026-42501 in cmd/go module-checksum validation. This reduces supply-chain exposure during release builds.

  • securityUnqualified references through search_path

    Resolution of unqualified references through search_path is changed because a database user can manipulate that path to shadow built-in objects.

Check if affected (1)

  • securitycriticaltarget_databases monitoring access

    Applies if your custom monitoring queries read user-owned tables or use target_databases: '*' against databases where PUBLIC CONNECT has been revoked.

    This release changes monitoring access so custom queries that read user-owned tables, or use target_databases: '*' where PUBLIC CONNECT is revoked, require explicit GRANT statements to cnpg_metrics_exporter. The change addresses CVE-2026-44477 and GHSA-423p-g724-fr39.

All 10 other recorded changesfixes 8 · value changes 2

fixes (8)

  • Fixed a failover window where the former primary kept its primary label.
  • Fixed failover not being triggered when the node hosting the primary becomes unreachable.
  • Fixed spurious failovers caused by transient failures on the primary's HTTP status endpoint.
  • Fixed escaping of backslashes and control characters in PostgreSQL configuration values.
  • Fixed restore_command construction to shell-quote each argument.
  • Malformed values are rejected at admission instead of failing later during PostgreSQL recovery.
  • Fixed snapshot restores failing when leftover pgsql_tmp* directories were present in the data directory.
  • Fixed a deadlock occurring when PVC storage size and resource requests are changed simultaneously.

value changes (2)

  • SBOM and SLSA provenance attached to operator container images now follow the OCI 1.1 Referrers spec, so standard registry tooling and supply-chain scanners can discover them automatically.
  • Switched TLS peer verification from VerifyPeerCertificate to VerifyConnection, which runs on every completed handshake
Add CloudNativePG to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All CloudNativePG releases →