CVE 2026 83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof , debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.

This vulnerability is rated as Moderate severity because exposure is confined to internal cluster network traffic and does not allow direct remote code execution or data modification. In default Multicluster Global Hub environments, the postgres-exporter service exposes profiling interfaces alongside metrics endpoints without network-level isolation or authentication. Although adjacent pods on the cluster network can trigger resource exhaustion through repeated CPU profiling or inspect memory dumps for connection details, exploitation requires existing presence within the private cluster network.

To mitigate this issue, restrict network access to the `postgres-exporter` service. Implement a Kubernetes `NetworkPolicy` to limit inbound connections to the `postgres-exporter` service's metrics port (9187) to only the Prometheus scraper or other trusted monitoring components within the cluster. This prevents unauthorized access to the exposed debug endpoints. Consult the OpenShift documentation for creating and applying `NetworkPolicy` resources.

Bugzilla 2526444 : postgres-exporter: net/http/pprof exposed on metrics listener

CWE-489 : Active Debug Code

Common Vulnerability Scoring System (CVSS) Score Details

Info alert: Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Red Hat CVSS v3 Score Explanation

From source audit FIND-002: pprof heap dumps leak DSN/password fragments, repeated CPU profiles cause DoS

Understanding the Weakness (CWE)

Confidentiality,Integrity,Availability,Access Control,Other

Technical Impact: Bypass Protection Mechanism; Read Application Data; Gain Privileges or Assume Identity; Varies by Context

Active debug code can create unintended entry points or expose sensitive information. The severity of the exposed debug code will depend on the particular instance. At the least, it will give an attacker sensitive information the settings and mechanics of web applications on the server. At worst, as is often the case, the debug code will allow an attacker complete control over the web application and server, as well as confidential information that either of these access.

Frequently Asked Questions

"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.

The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.

Upgrade to a supported product version that includes a fix for this vulnerability (recommended).

Apply a mitigation (if one exists).

Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Apply a mitigation (if one exists).

Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.

Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .