CVE-2026-83550
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Postgres-exporter: net/http/pprof exposed on metrics listener
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Multicluster Global Hub
- Vendor
- Red Hat
- Product
- Multicluster Global Hub
- Platforms
- Unknown
- Default status
affected- Package
- multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.