Overview
A critical privilege escalation vulnerability (CVE-2026-78155) has been disclosed in the StackGres operator, an open-source Kubernetes operator for managing PostgreSQL clusters. With a CVSS score of 9.9, this is one of the highest-severity cloud-native vulnerabilities published in 2026.
A low-privilege tenant who owns a database within a shared StackGres deployment can exploit this flaw to obtain full administrator privileges over the Kubernetes cluster — potentially compromising every other tenant's data and workloads running on the same infrastructure.
Technical Details
The vulnerability arises from insufficient privilege isolation within the StackGres operator's tenant model. The operator is responsible for provisioning and managing PostgreSQL instances on Kubernetes, and it exposes a management API and custom resource definitions (CRDs) for database owners to interact with their instances.
Under normal conditions, a database owner is expected to have access only to their assigned PostgreSQL instance. However, a flaw in the operator's authorization logic allows a crafted request to the management plane to bypass these boundaries and interact with cluster-level Kubernetes API primitives.
The specific attack surface involves the operator's handling of SGCluster or related custom resources, where an attacker with tenant-level credentials can submit a manipulated resource definition that is processed with elevated permissions. The result is effective administrative access to the Kubernetes control plane, including the ability to read secrets, escalate to cluster-admin, or modify workloads belonging to other tenants.
CVSS Breakdown
| Metric | Value |
|---|---|
| Score | 9.9 (Critical) |
| Vector | Network |
| Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
The combination of network-accessible attack surface, low complexity, and a changed scope (attacker moves from tenant context to cluster context) drives the near-perfect score.
Impact
Successful exploitation could allow an attacker to:
- Read Kubernetes Secrets across all namespaces, including credentials for other databases and applications
- Modify or delete workloads belonging to other tenants
- Escalate to
cluster-adminand establish persistence within the cluster - Exfiltrate sensitive data from all PostgreSQL instances managed by the operator
Multi-tenant deployments — including cloud-managed database platforms and shared Kubernetes clusters — are most at risk.
Affected Versions
All versions of the StackGres operator prior to the patched release are affected. Check the official StackGres advisory and release notes for the specific fixed version once published.
Mitigation
- Apply the patch as soon as the vendor releases a fixed version.
- Restrict network access to the StackGres operator API surface — do not expose management endpoints to untrusted networks.
- Audit tenant permissions on all StackGres deployments and review Kubernetes RBAC policies.
- Enable Kubernetes audit logging and alert on unexpected
cluster-adminbindings or cross-namespace API calls. - Consider isolating tenants to separate Kubernetes clusters if the risk cannot be mitigated by patching in time.