Information Disclosure Vulnerability in Postgres Exporter by Red Hat
CVE-2026-83550

7.1HIGH

Key Information:

Vendor

Red Hat
Status
Multicluster Global Hub
Vendor
CVE Published:
6 October 2026

What is CVE-2026-83550?

A security flaw exists in Postgres Exporter where the net/http/pprof import is left blank. This oversight exposes debug endpoints on the unauthenticated metrics listener, allowing remote attackers within the cluster network to access sensitive information. Exploiting this vulnerability can lead to the disclosure of critical data, including database connection strings, process arguments, and full goroutine stacks. Furthermore, persistent CPU profiling through these endpoints may disrupt service availability, making it essential to address this vulnerability promptly to ensure data integrity and system performance.

References

https://access.redhat.com/security/cve/CVE-2026-83550
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526444
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.