{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-104055",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-104055",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-10-02T20:35:50.514Z",
    "updatedAt": "2026-10-03T15:52:55.087Z",
    "importedAt": "2026-10-24T01:57:50.502Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm",
      "summary": "The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated \"monitoring\" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).",
      "affected": [
        {
          "vendor": "Canonical",
          "product": "postgresql-operator",
          "packageName": "charmed-postgresql",
          "collectionURL": "https://charmhub.io/postgresql",
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "charm-revision",
              "lessThan": "1189"
            },
            {
              "version": "0",
              "status": "affected",
              "versionType": "charm-revision",
              "lessThan": "1190"
            },
            {
              "version": "0",
              "status": "affected",
              "versionType": "charm-revision",
              "lessThan": "1216"
            },
            {
              "version": "0",
              "status": "affected",
              "versionType": "charm-revision",
              "lessThan": "1217"
            }
          ]
        }
      ]
    }
  }
}