CVE-2026-80220: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-80220 is a vulnerability in postgres-exporter where pprof profiling endpoints are exposed on an unauthenticated metrics listener, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability was reported on August 18, 2026, originating from a Project Glasswing AI-SAST security audit of postgres-exporter (finding FIND-001). The CVE was published on August 31, 2026, and remains under investigation by Red Hat Product Security. It carries a CVSS v3.1 base score of 5.4 (Medium), exploitable from an adjacent network without authentication or user interaction (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper access control over Go's built-in pprof HTTP profiling endpoints, which are inadvertently exposed on the same unauthenticated listener used for Prometheus metrics (CWE-200). The pprof package, when imported in a Go application, registers debug endpoints (e.g., /debug/pprof/) that can expose runtime profiling data including heap dumps, goroutine stacks, CPU profiles, and other internal application state. An attacker on the adjacent network can directly query these endpoints without any credentials, obtaining sensitive runtime information about the postgres-exporter process. The vulnerability was identified via static analysis (AI-SAST) and has been triaged as exploitable (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows an unauthenticated attacker on the adjacent network to access sensitive runtime profiling data from the postgres-exporter process, including memory contents, goroutine traces, and potentially database connection strings or credentials present in heap memory. There is also a low availability impact, as repeated or resource-intensive profiling requests (e.g., CPU profiling) can degrade the performance of the exporter. Integrity is not directly affected. The scope is limited to the postgres-exporter instance itself, though exposed memory data could facilitate further attacks against monitored PostgreSQL databases (Red Hat CVE, Red Hat Bugzilla).

The CVE status is currently "Reserved" with no public exploit code or PoC confirmed at this time. The vulnerability requires no authentication and no user interaction, and is reachable from the adjacent network segment where the metrics listener is exposed. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the CVE has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS score data is not yet available as the CVE was recently published (Red Hat CVE).

1. Reconnaissance: Identify hosts on the adjacent network running postgres-exporter, typically listening on TCP port 9187 (default metrics port), using network scanning tools such as nmap.
2. Discover pprof endpoints: Send an HTTP GET request to http://<target>:9187/debug/pprof/ to confirm the pprof index page is accessible without authentication.
3. Extract profiling data: Query specific pprof endpoints to gather sensitive runtime information:
   • GET /debug/pprof/heap — download a heap memory profile (may contain credentials or connection strings)
   • GET /debug/pprof/goroutine?debug=2 — enumerate all goroutine stack traces
   • GET /debug/pprof/profile?seconds=5 — trigger a 5-second CPU profile (causes availability degradation)
4. Analyze collected data: Parse the downloaded pprof profiles using Go's pprof tool or go tool pprof to extract readable memory contents, potentially revealing database credentials or internal configuration (Red Hat Bugzilla).

• Network: Unexpected HTTP GET requests to /debug/pprof/ or sub-paths (e.g., /debug/pprof/heap, /debug/pprof/goroutine, /debug/pprof/profile) on the postgres-exporter metrics port (default: 9187) from hosts that are not authorized monitoring systems.
• Logs: Web server or access logs for the metrics listener showing requests to /debug/pprof/* endpoints from unexpected source IP addresses.
• Process: Elevated CPU usage on the postgres-exporter process coinciding with requests to /debug/pprof/profile, indicating active CPU profiling by an external actor.

Red Hat Product Security is actively investigating the vulnerability; no fixed version has been publicly announced yet. As an immediate workaround, restrict network access to the postgres-exporter metrics listener (default port 9187) using firewall rules or network policies so that only authorized monitoring systems can reach it — this eliminates the adjacent-network attack vector. Additionally, operators can configure postgres-exporter to disable or not import the net/http/pprof package, or bind the metrics listener to a non-routable interface if external access is not required. Monitor the Red Hat CVE page and Bugzilla entry for patch availability (Red Hat CVE, Red Hat Bugzilla).