# CloudNativePG v1.29.1

> Storage & Data · 2026-05-08

A security-focused maintenance release reduces exporter privileges and updates Go and `pgx` components for upstream security fixes. It also includes failover and configuration correctness fixes, supply-chain metadata improvements, and monitoring changes that may require explicit grants or ordered upgrades.

## Action needed
- **[security · critical]** The metrics exporter authentication role
  - The metrics exporter no longer authenticates as the `postgres` superuser. This release uses the dedicated `cnpg_metrics_exporter` role with only `pg_monitor` privileges, addressing `CVE-2026-44477` and `GHSA-423p-g724-fr39`.
- **[security · critical]** `github.com/jackc/pgx/v5` at `v5.9.2`
  - This release updates `github.com/jackc/pgx/v5` to `v5.9.2` for upstream fixes addressing `CVE-2026-33816` in `pgproto3` and `GHSA-j88v-2chj-qfwx` in simple-protocol dollar-quoted string handling.
- **[security · high]** `Go` 1.26.3 runtime library fixes
  - The release is built with `Go` 1.26.3 for upstream fixes in `crypto/x509`, `crypto/tls`, `net/http`, and `net`. The update addresses `CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-33810`, `CVE-2026-33811`, `CVE-2026-33814`, and `CVE-2026-39825`.
- **[security · high]** `cmd/go` module-checksum validation
  - The `Go` 1.26.3 update also addresses `CVE-2026-42501` in `cmd/go` module-checksum validation. This reduces supply-chain exposure during release builds.
- **[security]** Unqualified references through `search_path`
  - Resolution of unqualified references through `search_path` is changed because a database user can manipulate that path to shadow built-in objects.

## Check if affected
- **[security · critical]** `target_databases` monitoring access
  - Applies if your custom monitoring queries read user-owned tables or use `target_databases: '*'` against databases where `PUBLIC CONNECT` has been revoked.
  - This release changes monitoring access so custom queries that read user-owned tables, or use `target_databases: '*'` where `PUBLIC CONNECT` is revoked, require explicit `GRANT` statements to `cnpg_metrics_exporter`. The change addresses `CVE-2026-44477` and `GHSA-423p-g724-fr39`.

## Other recorded changes
- 10 (defect_corrected 8, value_changed 2)

[Full analysis](https://ratatosk.io/en/releases/cloudnativepg/v1.29.1)

[Original release notes](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.1)