StackGres CVSS 9.9 Bug Escalates DB Tenant to Admin
CVE-2026-78155 (CVSS 9.9): StackGres Kubernetes operator lets a low-privilege database tenant escalate to administrator. Patch immediately.
Marisol "Fuse" DelgadoStackGres, the open-source Kubernetes operator for running production PostgreSQL, is carrying a critical privilege escalation flaw. CVE-2026-78155 scores 9.9 CVSS Critical — a low-privilege tenant who owns a database can escalate to cluster administrator.
If you’re running StackGres on Kubernetes, patch first, read later.
The flaw
The StackGres operator manages PostgreSQL clusters as Kubernetes custom resources. CVE-2026-78155 is a privilege isolation failure in the operator: a tenant with database ownership — a scoped, low-privilege role — can leverage the flaw to acquire administrator-level access across the cluster.
CVSS 9.9 reflects how little you need to trigger this. The prerequisite isn’t a foothold in your infrastructure or a compromised service account. It’s just a database tenant. In multi-tenant environments — internal managed database platforms, CI/CD systems that own their own DB instances, SaaS backends where multiple teams share a StackGres cluster — a single compromised or malicious account becomes a full cluster compromise.
What to do
- Identify your version and cross-reference against the StackGres tracking issue for affected release(s) and the fix. Apply the patch.
- Audit tenant accounts. Know exactly who holds database ownership in your cluster. Multi-tenant deployments are the highest-risk scenario here — if you can’t account for all tenant access, assume worst-case until you can.
- Review Kubernetes audit logs. If you cannot confirm the cluster was clean before patching, look for anomalous operator activity, unexpected role bindings, or privilege escalation events. The fix closes the door; the audit tells you whether someone was already through it.
Watch the StackGres GitLab project and the OnGres release announcements for the full advisory and patch version confirmation.
No public exploitation has been reported as of August 24, but the low privilege bar here makes this high-urgency. Don’t let “no observed exploitation” be your reason to delay.
Related: Azure CosmosEscape Flaw Exposed Any Tenant’s Database · Fortune 500 Firms Named in Azure Data Theft Claim · NadMesh botnet raids exposed AI tools for 3,811 AWS keys
Found this useful? Share it.
