CVE-2026-83550

HighCVSS 7.1/10Last modified Oct 7, 2026

Description

A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-489

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 6, 2026
Last modified
Oct 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-835517.2Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11CVE-2026-835555.3The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a suCVE-2026-835575.6DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly CVE-2026-83565.4LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement reCVE-2026-835605.3The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when theCVE-2026-835617.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via ElemCVE-2026-835626.5Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.CVE-2026-835647.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835655.5Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.CVE-2026-835667.0Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-835677.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835687.8Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.