CVE-2026-78155

The CVSS 9.9 rating against an EPSS of 0.00479 for this StackGres operator privilege escalation vulnerability reveals something important: the gap isn't a scoring failure — it's evidence that the vulnerable configuration (multi-tenant StackGres deployments where tenant-to-admin escalation actually means something) is uncommon in production. Defenders should treat this as a signal, not a contradiction. The vulnerability stems from the StackGres operator accepting and acting on requests from tenant contexts without properly validating whether the requesting principal has the authority to manage cluster-wide resources. This is a well-documented failure pattern in Kubernetes operators: the operator trusts client-supplied identity metadata or ownership claims rather than performing independent RBAC evaluation against the requesting principal's actual permissions. The operator runs with cluster-wide privileges while individual tenants should be namespace-scoped — when this boundary breaks, tenant contexts can trigger operator actions that escalate privileges. For detection, audit your StackGres deployment: identify whether multiple tenants share the same StackGres operator instance and whether those tenants are mutually untrusted. If your deployment is single-tenant or if tenants share a common security domain, the actual exploitability is substantially lower than the CVSS suggests. However, do not assume you're unaffected without confirming this — the operator's authorization logic may still contain the flaw even if your current configuration doesn't trigger it. The patch almost certainly removes the specific attack vector — likely client-supplied namespace or ownerReference manipulation — without restructuring the fundamental trust model. This follows the established pattern for operator authorization CVEs: the specific hole gets closed, the underlying architectural assumption remains, and variants emerge within 12-18 months. Treat this CVE as a family announcement rather than an isolated incident. Prioritize: confirm your StackGres version against the patched release, audit your multi-tenancy configuration, and verify that the operator performs proper subject access review rather than trusting ownership claims. If you're running StackGres in a multi-tenant environment, treat this as critical. If you're not, validate that your compensating controls are explicit rather than accidental.

Reviewed through automated stages and approved by a human before publication.