docs: import CloudNativePG main

Author: cnpg-bot

website/docs/installation_upgrade.md

@@ -277,18 +277,20 @@ only the operator itself.
 
 These releases introduce changes worth reviewing before you upgrade. Two are
 security changes that apply to **1.30.0, 1.29.2, and 1.28.4**: operator-side
-password encoding and `search_path` hardening. The other three are new in
+password encoding (`CVE-2026-55765`) and `search_path` hardening
+(`CVE-2026-55769`). The other three are new in
 **1.30.0** only: the `DatabaseRole` resource for declarative role management,
 safe primary election via a per-cluster Lease, and operator-to-instance
-authentication on the instance manager's status port.
+authentication on the instance manager's status port (`GHSA-7qwx-x8ff-3px9`).
 In addition, if you are upgrading from a release **older than 1.29.1 or 1.28.3**,
 the metrics-exporter privilege separation from `CVE-2026-44477` also applies.
 Each is covered in its own subsection below.
 
-#### Operator-side password encoding
+#### Operator-side password encoding (`CVE-2026-55765`)
 
-Starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons,
-CloudNativePG SCRAM-SHA-256 encodes role passwords **operator-side**
+Starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons
+(`CVE-2026-55765` / `GHSA-w3gf-xc94-wvmj`), CloudNativePG SCRAM-SHA-256 encodes
+role passwords **operator-side**
 (client-side from PostgreSQL's point of view) before issuing
 `CREATE`/`ALTER ROLE` statements. As a result, the literal that reaches
 the PostgreSQL parser (and that extensions such as `pg_stat_statements`
@@ -328,10 +330,11 @@ according to its own `password_encryption` GUC.
 See ["Opting out of operator-side encoding"](declarative_role_management.md#opting-out-of-operator-side-encoding)
 for details.
 
-#### `search_path` hardening
+#### `search_path` hardening (`CVE-2026-55769`)
 
-Also starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons,
-CloudNativePG pins the `search_path` to a fixed `pg_catalog, public,
+Also starting from versions 1.30.0, 1.29.2, and 1.28.4, for security reasons
+(`CVE-2026-55769` / `GHSA-x8c2-3p4r-v9r6`), CloudNativePG pins the `search_path`
+to a fixed `pg_catalog, public,
 pg_temp` on every connection it opens to PostgreSQL, so that a
 tenant-controlled `ALTER DATABASE`/`ALTER ROLE` setting can no longer
 influence how operator-issued queries resolve unqualified object names.
@@ -389,13 +392,16 @@ and `watch` verbs on `leases` in the `coordination.k8s.io` API group before
 upgrading, otherwise primaries will be unable to promote.
 :::
 
-#### Operator-to-instance authentication
+#### Operator-to-instance authentication (`GHSA-7qwx-x8ff-3px9`)
 
 Starting from version 1.30.0, the operator authenticates its calls to the
 sensitive endpoints of the instance manager's status port (backup,
 `pg_controldata`, partial WAL archive, and instance-manager upgrade) by pinning
 an in-memory client certificate. This is enabled automatically and requires no
-configuration. Status, health, and probe endpoints remain unauthenticated. See
+configuration. Status, health, and probe endpoints remain unauthenticated.
+This hardening is not backported; on releases earlier than 1.30.0, continue to
+restrict the status port (TCP 8000) with a `NetworkPolicy`, which remains its
+security boundary there. See
 [Operator-to-instance authentication](security.md#operator-to-instance-authentication)
 for details.
 

website/docs/release_notes/old/v1.28.md

@@ -58,7 +58,8 @@ is no longer supported.
 
 ### Security and Supply Chain
 
-- **`search_path` pinning on operator-issued connections**: a database owner
+- **`CVE-2026-55769` / `GHSA-x8c2-3p4r-v9r6`: `search_path` pinning on
+  operator-issued connections**: a database owner
   could plant overloaded built-in operators in the `public` schema and alter the
   `search_path` so that operator introspection probes, running as the cluster
   superuser, resolved those overloads before `pg_catalog`, a `CWE-426`
@@ -67,16 +68,17 @@ is no longer supported.
   `search_path = pg_catalog, public, pg_temp` on every pooled connection so it
   ships in the startup message and takes precedence over tenant-controlled
   defaults.
-  ([#10774](https://github.com/cloudnative-pg/cloudnative-pg/pull/10774)) <!-- 1.29 1.28 1.25 -->
+  ([#10774](https://github.com/cloudnative-pg/cloudnative-pg/pull/10774), [`GHSA-x8c2-3p4r-v9r6`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-x8c2-3p4r-v9r6)) <!-- 1.29 1.28 1.25 -->
 
-- **Operator-side SCRAM-SHA-256 password encoding**: the operator now
+- **`CVE-2026-55765` / `GHSA-w3gf-xc94-wvmj`: operator-side SCRAM-SHA-256
+  password encoding**: the operator now
   SCRAM-SHA-256 encodes cleartext role passwords before issuing
   `CREATE`/`ALTER ROLE ... PASSWORD`, so the literal PostgreSQL parses (and that
   extensions such as `pg_stat_statements` or `pgaudit` may capture) is the SCRAM
   verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values
   are forwarded unchanged, and the per-Secret annotation
   `cnpg.io/passwordPassthrough: "enabled"` opts out.
-  ([#10724](https://github.com/cloudnative-pg/cloudnative-pg/pull/10724)) <!-- 1.29 1.28 1.25 -->
+  ([#10724](https://github.com/cloudnative-pg/cloudnative-pg/pull/10724), [`GHSA-w3gf-xc94-wvmj`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-w3gf-xc94-wvmj)) <!-- 1.29 1.28 1.25 -->
 
 ### Changes
 

website/docs/release_notes/v1.29.md

@@ -59,7 +59,8 @@ on the release branch in GitHub.
 
 ### Security and Supply Chain
 
-- **`search_path` pinning on operator-issued connections**: a database owner
+- **`CVE-2026-55769` / `GHSA-x8c2-3p4r-v9r6`: `search_path` pinning on
+  operator-issued connections**: a database owner
   could plant overloaded built-in operators in the `public` schema and alter the
   `search_path` so that operator introspection probes, running as the cluster
   superuser, resolved those overloads before `pg_catalog`, a `CWE-426`
@@ -68,16 +69,17 @@ on the release branch in GitHub.
   `search_path = pg_catalog, public, pg_temp` on every pooled connection so it
   ships in the startup message and takes precedence over tenant-controlled
   defaults.
-  ([#10774](https://github.com/cloudnative-pg/cloudnative-pg/pull/10774)) <!-- 1.29 1.28 1.25 -->
+  ([#10774](https://github.com/cloudnative-pg/cloudnative-pg/pull/10774), [`GHSA-x8c2-3p4r-v9r6`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-x8c2-3p4r-v9r6)) <!-- 1.29 1.28 1.25 -->
 
-- **Operator-side SCRAM-SHA-256 password encoding**: the operator now
+- **`CVE-2026-55765` / `GHSA-w3gf-xc94-wvmj`: operator-side SCRAM-SHA-256
+  password encoding**: the operator now
   SCRAM-SHA-256 encodes cleartext role passwords before issuing
   `CREATE`/`ALTER ROLE ... PASSWORD`, so the literal PostgreSQL parses (and that
   extensions such as `pg_stat_statements` or `pgaudit` may capture) is the SCRAM
   verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values
   are forwarded unchanged, and the per-Secret annotation
   `cnpg.io/passwordPassthrough: "enabled"` opts out.
-  ([#10724](https://github.com/cloudnative-pg/cloudnative-pg/pull/10724)) <!-- 1.29 1.28 1.25 -->
+  ([#10724](https://github.com/cloudnative-pg/cloudnative-pg/pull/10724), [`GHSA-w3gf-xc94-wvmj`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-w3gf-xc94-wvmj)) <!-- 1.29 1.28 1.25 -->
 
 ### Changes
 

website/docs/release_notes/v1.30.md

@@ -132,7 +132,8 @@ on the release branch in GitHub.
 
 ### Security
 
-- **`search_path` pinning on operator-issued connections**: a database owner
+- **`CVE-2026-55769` / `GHSA-x8c2-3p4r-v9r6`: `search_path` pinning on
+  operator-issued connections**: a database owner
   could plant overloaded built-in operators in the `public` schema and alter the
   `search_path` so that operator introspection probes, running as the cluster
   superuser, resolved those overloads before `pg_catalog`, a `CWE-426`
@@ -141,25 +142,30 @@ on the release branch in GitHub.
   `search_path = pg_catalog, public, pg_temp` on every pooled connection so it
   ships in the startup message and takes precedence over tenant-controlled
   defaults.
-  ([#10774](https://github.com/cloudnative-pg/cloudnative-pg/pull/10774)) <!-- 1.29 1.28 1.25 -->
-
-- **Authenticated operator-to-instance-manager calls**: the instance manager's
-  remote webserver previously accepted unauthenticated requests, so any process
-  on the pod network could trigger backups, instance manager upgrades, or WAL
-  archival. The operator now generates an in-memory ECDSA P-256 client
-  certificate at startup and reconciles its SHA-256 fingerprint into the cluster
-  status; the instance manager rejects requests to sensitive endpoints that do
-  not present a matching certificate.
-  ([#10579](https://github.com/cloudnative-pg/cloudnative-pg/pull/10579))
-
-- **Operator-side SCRAM-SHA-256 password encoding**: the operator now
+  ([#10774](https://github.com/cloudnative-pg/cloudnative-pg/pull/10774), [`GHSA-x8c2-3p4r-v9r6`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-x8c2-3p4r-v9r6)) <!-- 1.29 1.28 1.25 -->
+
+- **`GHSA-7qwx-x8ff-3px9`: authenticated operator-to-instance-manager calls**:
+  the instance manager's remote webserver relied on network isolation rather
+  than authentication for its operator-only control endpoints, so any party able
+  to reach the pod's status port could invoke them, disrupting backup
+  orchestration and WAL archival and reading operational metadata. (The upgrade
+  endpoint is SHA-256-pinned, so this did not permit arbitrary code execution.)
+  The operator now generates an in-memory ECDSA P-256 client certificate at
+  startup and reconciles its SHA-256 fingerprint into the cluster status; the
+  instance manager rejects requests to sensitive endpoints that do not present a
+  matching certificate. This hardening is not backported; earlier releases
+  should continue to restrict the status port with a `NetworkPolicy`.
+  ([#10579](https://github.com/cloudnative-pg/cloudnative-pg/pull/10579), [`GHSA-7qwx-x8ff-3px9`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-7qwx-x8ff-3px9))
+
+- **`CVE-2026-55765` / `GHSA-w3gf-xc94-wvmj`: operator-side SCRAM-SHA-256
+  password encoding**: the operator now
   SCRAM-SHA-256 encodes cleartext role passwords before issuing
   `CREATE`/`ALTER ROLE ... PASSWORD`, so the literal PostgreSQL parses (and that
   extensions such as `pg_stat_statements` or `pgaudit` may capture) is the SCRAM
   verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values
   are forwarded unchanged, and the per-Secret annotation
   `cnpg.io/passwordPassthrough: "enabled"` opts out.
-  ([#10724](https://github.com/cloudnative-pg/cloudnative-pg/pull/10724)) <!-- 1.29 1.28 1.25 -->
+  ([#10724](https://github.com/cloudnative-pg/cloudnative-pg/pull/10724), [`GHSA-w3gf-xc94-wvmj`](https://github.com/cloudnative-pg/cloudnative-pg/security/advisories/GHSA-w3gf-xc94-wvmj)) <!-- 1.29 1.28 1.25 -->
 
 ### Changes