CVE-2026-78155: CWE-426: Untrusted Search Path in OnGres StackGres

This vulnerability in StackGres operator arises from an untrusted search path condition (CWE-426) that enables a low-privilege tenant with database ownership to gain administrator privileges. The flaw impacts the privilege model of the StackGres operator, potentially allowing unauthorized administrative control. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no user interaction, and scope change with high impact on confidentiality, integrity, and availability. No vendor advisory or patch details have been provided yet.

Successful exploitation allows a low-privilege tenant to escalate privileges to administrator level, compromising the confidentiality, integrity, and availability of the affected StackGres environment. This could lead to full control over the database operator functions and potentially the underlying infrastructure managed by StackGres.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted tenants and monitor for suspicious privilege escalations. Avoid running StackGres operator in environments where untrusted users have database ownership privileges.