postgres-exporter: Information disclosure via exposed pprof debug endpoints
Summary
The postgres-exporter exposes Go net/http/pprof debug endpoints on its unauthenticated metrics listener. A remote attacker with access to the cluster network can read process arguments, goroutine stacks and heap dumps, which may contain database connection strings or passwords. Repeated CPU profiling requests can also cause a denial of service.
Affected
- Red Hat Multicluster Global Hub (default configuration, according to the CNA record)
- Debian prometheus-postgres-exporter packages (per OSV record, versions not fully confirmed)
- Exact affected upstream versions: Unknown.
Fixed in
Unknown. No fixed version has been confirmed.
Workaround
- Restrict network access to the postgres-exporter metrics port (9187).
- Create a Kubernetes NetworkPolicy allowing inbound connections only from the Prometheus scraper or other trusted monitoring components.
- Block access to the exporter port at host and cloud firewalls and keep it off shared or user-facing networks.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Not listed in CISA KEV.
- No public proof of concept or evidence of in-the-wild exploitation found.
Our recommendation
- Apply the network restriction (NetworkPolicy or firewall rules) to the postgres-exporter service now.
- Check whether the exporter is exposed on shared or untrusted networks and verify which pprof endpoints respond.
- Update to a current upstream or vendor release once a fix is confirmed, and verify that the pprof endpoints are gone.
- If an exposed exporter may have been reached, rotate database passwords.
- Monitor access to the metrics port.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page access.redhat.com
- Red Hat Bugzilla 2526444 bugzilla.redhat.com
- OSV (Debian) record osv.dev
- Upstream postgres_exporter releases github.com
- OpenCVE CVE summary (KEV status, workaround) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 18:56.
Original description (NVD)
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.