Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-55765 is a high-severity Plaintext Storage of a Password (CWE-256) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Remote Services (T1021); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-63685
Vulnerability Data
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements…
more
was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V11.3.3
Mitigating Controls (NIST 800-53 r5) AI
Requiring confidentiality protection of information at rest directly stops passwords from being stored in plaintext.
Transmission confidentiality and integrity enforcement stops credentials from being sent in plaintext or without protection.
Authenticator management requires secure generation, storage, and distribution of credentials, directly stopping insecure methods.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential management practices normally include secure storage requirements for passwords.
Authentication policies can enforce stronger credential handling yet address only verification, not storage or transit protection.
Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.
Encryption and hashing of data-at-rest directly prevent plaintext password storage in files.
Encrypting data-in-transit fully prevents interception of credentials in motion while only partially satisfying the broader data-protection outcome.
Protecting data-in-use can limit exposure of passwords held in memory.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Acceptable-use expectations that cover protection of credentials and information assets throughout their lifecycle discourage practices that expose or mishandle authentication material.
Directly requires secure handling and protection of authentication information, preventing plaintext password storage.
Contractual clauses that survive termination help ensure that credentials and other secrets are not retained or misused after employment ends.
Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.
By requiring signatories to protect credentials and other authentication material under the same confidentiality terms, the control discourages the mishandling or exposure of credentials that could lead to unauthorized account access.
Requiring logical controls such as passwords or PINs on idle devices and the use of remote lockout mechanisms protects credentials and other sensitive material from offline extraction.