{"id":"CVE-2026-104055","summary":"Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm","details":"The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated \"monitoring\" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).","aliases":["GHSA-rcx7-7rh5-r542"],"modified":"2026-10-04T02:45:58.297907204Z","published":"2026-10-02T20:35:50.514Z","database_specific":{"cna_assigner":"canonical","cwe_ids":["CWE-532"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104055.json"},"references":[{"type":"WEB","url":"https://charmhub.io/postgresql"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104055.json"},{"type":"ADVISORY","url":"https://github.com/canonical/postgresql-operator/security/advisories/GHSA-rcx7-7rh5-r542"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104055"},{"type":"FIX","url":"https://github.com/canonical/charmed-postgresql-snap/pull/305"},{"type":"FIX","url":"https://github.com/canonical/charmed-postgresql-snap/pull/307"},{"type":"FIX","url":"https://github.com/canonical/postgresql-operator/pull/1863"},{"type":"PACKAGE","url":"https://github.com/canonical/postgresql-operator"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/canonical/postgresql-operator","events":[{"introduced":"0"},{"fixed":"d4c920944bb8d2776821650ad2c277d7f5bb687c"},{"fixed":"c9910b32b0472c6875364dcea807613063d24e08"},{"fixed":"4d14e0ff8301ae2db597fca947e8aa0e9dd79151"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"1189"},{"fixed":"1190"},{"fixed":"1216"},{"fixed":"1217"}]}}],"versions":["rev1215","rev1214","rev1211","rev1210","rev1205","rev1204","v16/1.328.0","rev1199","rev1198","rev1197","rev1196","rev1191","rev1190","v16/1.332.0","v16/1.331.0","v16/1.330.0","v16/1.329.0","v16/1.327.0","rev1187","rev1186","v16/1.326.0","v16/1.325.0","rev1185","rev1182","v16/1.324.0","v16/1.323.0","v16/1.322.0","rev1181","rev1180","v16/1.321.0","v16/1.320.0","v16/1.319.0","v16/1.318.0","v16/1.317.0","v16/1.316.0","v16/1.315.0","v16/1.314.0","v16/1.313.0","v16/1.312.0","v16/1.311.0","v16/1.310.0","rev1179","rev1178","v16/1.309.0","rev1174","rev1173","rev1177","rev1175","v16/1.308.0","v16/1.307.0","rev1172","rev1171","rev1166","rev1165","v16/1.306.0","rev1164","rev1163","v16/1.305.0","v16/1.304.0","v16/1.303.0","v16/1.302.0","rev1162","rev1161","v16/1.301.0","v16/1.300.0","rev1160","rev1159","v16/1.299.0","rev1158","rev1157","v16/1.298.0","v16/1.297.0","v16/1.296.0","v16/1.295.0","v16/1.294.0","v16/1.293.0","rev1154","rev1153","rev1156","rev1155","v16/1.292.0","rev1152","rev1151","v16/1.291.0","rev1150","rev1149","v16/1.290.0","v16/1.289.0","v16/1.288.0","v16/1.287.0","rev1148","rev1147","rev1146","rev1145","v16/1.286.0","v16/1.285.0","rev1144","rev1143","rev1142","rev1140","v16/1.284.0","rev1139","rev1138","v16/1.283.0","v16/1.282.0","v16/1.281.0","v16/1.242.0","rev1089","rev1088","v16/1.280.0","rev1134","rev1133","rev1130","rev1129","v16/1.279.0","v16/1.278.0","rev1132","rev1131","v16/1.277.0","rev1128","rev1127","v16/1.276.0","rev1126","rev1125","v16/1.275.0","v16/1.274.0","v16/1.273.0","rev1124","rev1123","v16/1.272.0","v16/1.271.0","v16/1.270.0","v16/1.269.0","v16/1.268.0","rev1122","rev1121","v16/1.267.0","rev1120","rev1119","v16/1.266.0","v16/1.265.0","rev1118","rev1117","v16/1.264.0","v16/1.263.0","v16/1.262.0","v16/1.261.0","v16/1.260.0","v16/1.259.0","v16/1.258.0","rev1105","rev1104","rev1103","rev1102","v16/1.257.0","rev1101","rev1100","v16/1.256.0","v16/1.255.0","v16/1.254.0","v16/1.253.0","v16/1.252.0","v16/1.251.0","v16/1.250.0","v16/1.249.0","rev1097","rev1096","rev1099","rev1098","v16/1.248.0","rev1095","rev1094","v16/1.247.0","v16/1.246.0","v16/1.245.0","v16/1.244.0","v16/1.243.0","rev1093","rev1092","rev1091","rev1090","rev1085","rev1084","v16/1.241.0","rev1087","rev1086","v16/1.240.0","v16/1.239.0","rev1083","rev1082","v16/1.238.0","v16/1.237.0","rev1081","rev1080","v16/1.236.0","v16/1.235.0","v16/1.234.0","v16/1.233.0","v16/1.232.0","v16/1.231.0","v16/1.230.0","v16/1.229.0","rev1079","rev1078","v16/1.228.0","rev1075","rev1074","rev1077","rev1076","v16/1.227.0","v16/1.226.0","v16/1.225.0","v16/1.224.0","rev1072","rev1071","v16/1.223.0","v16/1.222.0","rev1068","rev1067","rev1070","rev1069","rev1062","rev1061","v16/1.221.0","rev1066","rev1065","v16/1.220.0","v16/1.219.0","rev1064","rev1063","v16/1.218.0","v16/1.217.0","rev1059","rev1058","rev1055","rev1054","v16/1.216.0","rev1057","rev1056","v16/1.215.0","v16/1.214.0","v16/1.213.0","v16/1.212.0","v16/1.211.0","v16/1.210.0","rev1053","rev1052","v16/1.209.0","rev1051","rev1050","v16/1.208.0","rev1049","rev1048","v16/1.207.0","v16/1.206.0","rev1047","rev1046","v16/1.205.0","rev1045","rev1044","v16/1.204.0","v16/1.203.0","v16/1.202.0","rev1041","rev1040","rev1043","rev1042","rev1037","rev1036","v16/1.201.0","rev1039","rev1038","rev1035","rev1034","v16/1.200.0","rev1033","rev1032","v16/1.199.0","v16/1.198.0","v16/1.197.0","v16/1.196.0","v16/1.195.0","v16/1.194.0","rev1031","rev1030","rev1029","rev1028","v16/1.193.0","rev1027","rev1026","v16/1.192.0","rev1025","rev1024","v16/1.191.0","v16/1.190.0","rev1023","rev1022","v16/1.189.0","v16/1.188.0","rev1021","rev1020","v16/1.187.0","rev1019","rev1018","v16/1.186.0","v16/1.185.0","rev1017","rev1016","v16/1.184.0","rev1015","rev1013","v16/1.183.0","v16/1.182.0","v16/1.181.0","v16/1.180.0","v16/1.179.0","rev1011","rev1010","v16/1.178.0","v16/1.177.0","v16/1.176.0","v16/1.175.0","rev1002","rev1001","rev1009","rev1008","rev1004","rev1003","rev999","rev1000","v16/1.174.0","v16/1.173.0","rev994","rev993","v16/1.172.0","v16/1.171.0","v16/1.170.0","v16/1.169.0","rev998","rev997","v16/1.168.0","rev992","rev991","v16/1.167.0","v16/1.166.0","v16/1.165.0","rev990","rev989","v16/1.164.0","rev985","rev984","rev987","rev986","v16/1.163.0","v16/1.162.0","v16/1.161.0","rev981","rev980","v16/1.160.0","rev983","rev982","v16/1.159.0","rev979","rev978","v16/1.158.0","rev977","rev976","v16/1.157.0","v16/1.156.0","rev975","rev974","v16/1.155.0","v16/1.154.0","v16/1.153.0","rev973","rev972","v16/1.152.0","v16/1.151.0","rev971","rev970","v16/1.150.0","rev966","rev965","v16/1.149.0","v16/1.148.0","rev969","rev968","v16/1.147.0","v16/1.146.0","v16/1.145.0","v16/1.144.0","rev964","rev963","v16/1.143.0","rev960","rev959","rev962","rev961","v16/1.142.0","rev958","rev957","v16/1.141.0","v16/1.140.0","v16/1.139.0","v16/1.138.0","v16/1.137.0","rev954","rev953","v16/1.136.0","v16/1.135.0","rev952","rev951","v16/1.134.0","rev950","rev949","v16/1.133.0","v16/1.132.0","rev946","rev945","v16/1.59.0","rev844","rev843","v16/1.131.0","rev942","rev941","v16/1.130.0","rev944","rev943","v16/1.129.0","v16/1.128.0","rev940","rev939","v16/1.127.0","v16/1.126.0","rev938","rev937","rev936","rev935","v16/1.125.0","v16/1.124.0","rev934","rev933","rev930","rev929","v16/1.123.0","rev932","rev931","v16/1.122.0","v16/1.121.0","rev928","rev927","v16/1.120.0","rev926","rev925","v16/1.119.0","rev924","rev923","v16/1.118.0","rev922","rev921","v16/1.117.0","rev920","rev919","rev918","rev917","v16/1.116.0","rev914","rev913","v16/1.115.0","v16/1.114.0","rev916","rev915","v16/1.113.0","rev912","rev911","v16/1.112.0","rev910","rev909","rev908","rev907","v16/1.111.0","v16/1.110.0","rev904","rev903","rev906","rev905","v16/1.109.0","rev902","rev901","v16/1.108.0","v16/1.107.0","rev900","rev899","v16/1.106.0","v16/1.105.0","v16/1.104.0","rev898","rev897","v16/1.103.0","rev896","rev895","rev894","rev893","v16/1.102.0","v16/1.101.0","v16/1.100.0","v16/1.99.0","rev892","rev891","v16/1.98.0","rev890","rev889","v16/1.97.0","v16/1.96.0","rev886","rev885","v16/1.95.0","v16/1.94.0","v16/1.93.0","v16/1.92.0","rev884","rev883","v16/1.91.0","v16/1.90.0","rev882","rev881","rev880","rev879","v16/1.89.0","rev878","rev877","v16/1.88.0","v16/1.87.0","v16/1.86.0","v16/1.85.0","v16/1.84.0","v16/1.83.0","rev876","rev875","v16/1.82.0","v16/1.81.0","v16/1.80.0","rev872","rev871","v16/1.79.0","rev874","rev873","v16/1.78.0","v16/1.77.0","v16/1.76.0","v16/1.75.0","rev868","rev867","rev866","rev865","v16/1.74.0","rev864","rev863","rev862","rev861","v16/1.73.0","rev860","rev859","v16/1.72.0","v16/1.71.0","v16/1.70.0","rev858","rev857","v16/1.69.0","v16/1.68.0","v16/1.67.0","rev856","rev855","v16/1.66.0","v16/1.65.0","v16/1.64.0","rev848","rev847","v16/1.63.0","v16/1.62.0","v16/1.61.0","v16/1.60.0","v16/1.58.0","rev842","rev841","v16/1.57.0","v16/1.56.0","v16/1.55.0","rev837","rev836","v16/1.54.0","rev833","rev832","rev831","rev830","v16/1.53.0","v16/1.52.0","v16/1.51.0","rev824","rev823","v16/1.50.0","v16/1.49.0","rev822","rev821","v16/1.48.0","rev820","rev819","v16/1.47.0","v16/1.46.0","rev818","rev817","v16/1.45.0","rev810","rev809","v16/1.44.0","v16/1.43.0","v16/1.42.0","rev805","rev804","v16/1.41.0","v16/1.40.0","rev807","rev806","v16/1.39.0","rev803","rev802","rev801","rev800","v16/1.38.0","v16/1.37.0","v16/1.36.0","rev799","rev798","v16/1.35.0","v16/1.34.0","rev797","rev796","v16/1.33.0","rev791","rev790","v16/1.32.0","rev793","rev792","v16/1.31.0","rev789","rev788","v16/1.30.0","v16/1.29.0","v16/1.28.0","rev787","rev786","rev785","rev784","v16/1.27.0","v16/1.26.0","rev780","rev779","v16/1.25.0","v16/1.24.0","rev783","rev782","v16/1.23.0","rev778","rev777","v16/1.22.0","rev776","rev775","v16/1.21.0","v16/1.20.0","v16/1.19.0","rev773","rev772","v16/1.18.0","rev771","rev770","v16/1.17.0","rev764","rev763","v16/1.16.0","rev769","rev768","v16/1.15.0","v16/1.14.0","v16/1.13.0","v16/1.12.0","rev767","rev766","v16/1.11.0","v16/1.10.0","rev741","rev740","v16/1.9.0","v16/1.8.0","rev758","rev757","v16/1.7.0","v16/1.6.0","v16/1.5.0","rev756","rev755","v16/1.4.0","v16/1.3.0","v16/1.2.0","v16/1.1.0","rev754","rev753","v16/1.0.0","rev743","rev742","rev735","rev734","rev708","rev707","rev706","rev705","rev702","rev701","rev616","rev615","rev613","rev612","rev610","rev609","rev606","rev605","rev608","rev607","rev603","rev602","rev601","rev600","rev599","rev598","rev595","rev594","rev597","rev596","rev593","rev592","rev590","rev589","rev584","rev583","rev588","rev587","rev578","rev577","rev582","rev581","rev580","rev579","rev576","rev575","rev574","rev573","rev572","rev571","rev570","rev568","rev565","rev564","rev567","rev566","rev563","rev562","rev561","rev560","rev559","rev558","rev557","rev556","rev555","rev554","rev553","rev552","rev551","rev550","rev549","rev548","rev547","rev546","rev545","rev544","rev543","rev542","rev541","rev540","rev539","rev538","rev537","rev536","rev535","rev534","rev533","rev532","rev531","rev530","rev529","rev528","rev522","rev521","rev520","rev519","rev518","rev517","rev516","rev515","rev514","rev513","rev512","rev511","rev508","rev507","rev506","rev505","rev503","rev502","rev501","rev500","rev499","rev498","rev497","rev496","rev495","rev494","rev493","rev492","rev491","rev490","rev487","rev486","rev485","rev484","rev482","rev481","rev480","rev479","rev478","rev477","rev476","rev475","rev474","rev473","rev472","rev471","rev470","rev469","rev468","rev467","rev466","rev465","rev464","rev463","rev462","rev461","rev460","rev459","rev458","rev457","rev456","rev455","rev454","rev453","rev452","rev451","rev450","rev449","rev446","rev445","rev444","rev442","rev440","rev438","rev436","rev434","rev432","rev430","rev429","rev428","rev426","rev424","rev422","rev420","rev418","rev416","rev413","rev411","rev409","rev407","rev405","rev403","rev401","rev399","rev396","rev393","rev391","rev389","rev386","rev384","rev382","rev380","rev378","rev376","rev372","rev371","rev370","rev369","rev368","rev367","rev365","rev364","rev363","rev361","rev360","rev359","rev358","rev357","rev356","rev355","rev354","rev351","rev350","rev349","rev348","rev347","rev346","rev340","rev339","rev338","rev337","rev336","rev335","rev334","rev333","rev332","rev331","rev330","rev329","rev328","rev327","rev326","rev325","rev324","rev323","rev322","rev321","rev320","rev319","rev318","rev317","rev315","rev314","rev313","rev312","rev311","rev310","rev309","rev308","rev307","rev306","rev305","rev304","rev303","rev302","rev301","rev300","rev299","rev298","rev297","rev296","rev295","rev294","rev293","rev292","rev291","rev289","rev288","rev287","rev286","rev285","rev284","rev283","rev281","rev280","rev279","rev278","rev277","rev276","rev275","rev274","rev273","rev272","rev271","rev268","rev267","rev266","rev265","rev264","rev263","rev262","rev261","rev260","rev259","rev258","rev257","rev255","rev254","rev253","rev252","rev251","rev250","rev249","rev248","rev247","rev245","rev244","rev243"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104055.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}