Daily Digest
The single most urgent item within the Database scope this cycle is CVE-2026-104055 affecting the Canonical Charmed PostgreSQL Snap (`postgresql-operator`). While no CISA KEV-confirmed active exploitation entries currently exist for database systems in this digest, the cleartext logging of the monitoring user's password by the `postgres_exporter` represents a critical credential exposure vector. For environments running Postgres in Kubernetes or cloud environments utilizing the charmed operator, any actor with read access to the application logs can trivially recover database credentials, bypassing standard secret management (such as Vault PKI/mTLS setups) and gaining read-only database access. Immediate action should be taken to upgrade to the patched stable revisions, especially on any multi-node clusters where centralized logging aggregates these host logs.
Summary: The `postgresql-operator` charm runs a Prometheus `postgres_exporter` to collect metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only `pg_monitor` access to PostgreSQL. This is a logic/credential exposure flaw rather than a remote network exploit, requiring local or aggregated log access to trigger.
Affected Features / Interoperability: The flaw specifically impacts the metrics exporter component (`postgres_exporter`) of the `charmed-postgresql-snap` package. It compromises the security of the `pg_monitor` role credentials. The raw data does not specify further downstream integrations beyond the read-only `pg_monitor` access, but any centralized logging stack (e.g., Loki, ELK, Fluentd) collecting these exporter logs will retain plaintext copies of the database password.
Source:
Actions:
---
The following items are unverified community and news chatter, separate from official NVD/CISA vulnerability confirmations. They should be treated as informational context only.
No CISA KEV-confirmed vulnerabilities were reported in the formal feed for Cloud Security today, so there is no confirmed-exploitation item to prioritize; the most urgent unverified chatter centers on critical Dell Container Storage Modules (CSM) flaws that may allow unauthenticated admin access and root compromise on Kubernetes nodes.
No formal vulnerability entries were provided for this scope.
Unverified chatter — not authoritative, do not treat as CVEs.
AWS
Kubernetes
Docker