# CloudNativePG v1.28.4

> Storage & Data · 2026-06-29

A maintenance release with security fixes, stricter API validation, support and default-version updates, and correctness fixes across cluster operations and the cnpg plugin. It also updates Kubernetes support, autoscaler integration, and cluster status visibility.

## Check if affected
- **[security · critical]** `search_path` pinning on pooled connections
  - Applies if you use pooled connections.
  - The operator now pins `search_path = pg_catalog, public, pg_temp` on every pooled connection, so the value is included in the startup message and takes precedence over tenant-controlled defaults. The change is associated with `CVE-2026-55769` and `GHSA-x8c2-3p4r-v9r6`.
- **[security · high]** SCRAM-SHA-256 encoding for cleartext role passwords
  - Applies if you use cleartext role passwords.
  - The operator now encodes cleartext role passwords with `SCRAM-SHA-256` before issuing `CREATE` or `ALTER ROLE ... PASSWORD`. The change concerns `cnpg.io/passwordPassthrough` and is associated with `CVE-2026-55765` and `GHSA-w3gf-xc94-wvmj`.
- **[breaking]** `cluster` reference immutability
  - Applies if you use the `cluster` reference on `Database`, `Pooler`, `Publication`, `Subscription`, or `ScheduledBackup` resources.
  - The `cluster` reference is now immutable on `Database`, `Pooler`, `Publication`, `Subscription`, and `ScheduledBackup` resources.
- **[breaking]** Validating webhook and write-site rejection
  - Applies if you use values checked by the validating webhook.
  - The validating webhook now rejects these values, and the write site checks them again.

## Plan ahead
- **[deprecated]** `1.28` support ending
  - Applies if you run `1.28`.
  - This is the final release in the `1.28.x` series, and `1.28` is no longer supported. The notice encourages users to move to a newer minor version.
- **[deprecated]** Native (in-tree) Barman Cloud support deprecation
  - Applies if you use `native (in-tree) Barman Cloud support`.
  - removal planned in 1.31.0
  - The deprecation notice now says that `native (in-tree) Barman Cloud support` will be removed in `1.31.0` instead of `1.30.0`. It encourages migration to the Barman Cloud Plugin.

## Other recorded changes
- 35 (defect_corrected 30, added 2, value_changed 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/cloudnativepg/v1.28.4)

[Original release notes](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.28.4)