Security readout for executives and security teams
Plain-English summary
A low-privilege StackGres tenant who owns a database may be able to gain administrator privileges through the operator. Successful exploitation could compromise protected data, configurations, and service availability beyond the tenant’s intended boundary.
Executive priority
Treat potentially matching multi-tenant StackGres deployments as an immediate investigation priority because the reported outcome is administrator compromise. Do not assume every release is vulnerable: version scope and a fixed release are not established in the supplied evidence. Obtain vendor confirmation before making broad upgrade claims.
Technical view
CVE-2026-78155 is classified as CWE-426, Untrusted Search Path. The StackGres operator reportedly allows a low-privilege database owner to escalate to administrator privileges. CVSS 3.1 scores it 9.9, reflecting network reachability, low complexity, limited initial privileges, no user interaction, changed scope, and high impact.
Likely exposure
Potential exposure is limited to StackGres environments matching the reported condition: an untrusted, low-privilege tenant owns a database. The supplied version value, "0," is insufficient to determine affected releases, while the record’s default status is unaffected. Confirm applicability with OnGres.
Exploitation context
The bundle provides no evidence of active exploitation, and this CVE is not listed as KEV. It also provides no public exploit details. The reported prerequisite is legitimate low-privilege tenant access combined with database ownership.
Researcher notes
The strongest evidence is the CVE description, CWE-426 classification, CVSS vector, and linked OnGres work item. The bundle does not explain the precise search-path mechanism, affected release range, indicators of compromise, patch, workaround, or exploitation prevalence. Avoid extrapolating beyond database-owning low-privilege tenants.
Mitigation direction
- Check the OnGres issue and CVE record for updated affected-version and remediation guidance.
- Inventory StackGres installations and ask OnGres whether each deployed release is affected.
- Until clarified, restrict database ownership and operator access for untrusted tenants where operationally feasible.
- Review operator and tenant privilege boundaries for unexpected administrator access.
Validation and detection
- Record every StackGres version and deployment where tenants can interact with the operator.
- Identify low-privilege tenants that own databases and prioritize those environments for review.
- Review available audit records for unexpected administrator privilege changes associated with tenant-controlled databases.
- Compare installed versions with subsequent OnGres guidance; document unresolved version scope explicitly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-426: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-78155 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16GitLabVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://gitlab.com/ongresinc/stackgres/-/work_items/3177CVE reference, GitLab
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Untrusted Search Path
Untrusted Search Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.