# CloudNativePG v1.28.3

> Storage & Data · 2026-05-08

A security-focused maintenance release with dependency and Go runtime remediations. It also includes failover and configuration correctness fixes, including a monitoring-role migration and stricter validation that affect operator-visible behavior.

## Action needed
- **[security · critical]** The `github.com/jackc/pgx/v5` dependency at v5.9.2
  - The `github.com/jackc/pgx/v5` dependency was bumped to v5.9.2 for upstream fixes addressing `CVE-2026-33816` in `pgproto3` and `GHSA-j88v-2chj-qfwx` involving SQL injection through simple-protocol dollar-quoted string handling.
- **[security · high]** Go runtime built with Go 1.26.3
  - The Go runtime is built with Go 1.26.3 to include upstream fixes in `crypto/x509`, `crypto/tls`, `net/http`, and `net`. The build includes fixes for `CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-33810`, `CVE-2026-33814`, `CVE-2026-33811`, and `CVE-2026-39825`.
- **[security · high]** `cmd/go` module-checksum validation
  - The Go 1.26.3 update also addresses `CVE-2026-42501`, which concerns `cmd/go` module-checksum validation during release builds.
- **[security]** Unqualified reference resolution through `search_path`
  - Unqualified references resolve through `search_path`, which a database user can manipulate to shadow built-in objects.

## Check if affected
- **[security · critical]** Metrics exporter authentication and monitoring role
  - Applies if the metrics exporter runs.
  - The metrics exporter now uses the dedicated `cnpg_metrics_exporter` role with `pg_monitor` privileges instead of authenticating as the `postgres` superuser. This closes the privilege-escalation chain described by `CVE-2026-44477` and `GHSA-423p-g724-fr39`.

## Other recorded changes
- 10 (defect_corrected 8, added 1, value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/cloudnativepg/v1.28.3)

[Original release notes](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.3)