CVE-2026-83550
Last modified
CVE-2026-83550 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Multicluster Global Hub | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-83550?
How severe is CVE-2026-83550?
How do I fix CVE-2026-83550?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-83545The CoolClock WordPress plugin before 4.3.8 does not properl…6.8
- CVE-2026-83546The CoolClock WordPress plugin before 4.3.8 does not properl…6.8
- CVE-2026-83547The Xpro Addons WordPress plugin before 1.7.4 does not prope…6.8
- CVE-2026-83548A Pre-authentication SSRF vulnerability exists in the SMA100…10
- CVE-2026-83549Post-authentication Improper Neutralization of Special Eleme…7.8
- CVE-2026-8355IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerab…5.4
- CVE-2026-83551Cleartext storage of sensitive information in the @step and …7.2
- CVE-2026-83555The Email Subscribers & Newsletters WordPress plugin before…5.3
- CVE-2026-83557DefaultBaseTypeLimitingValidator is the PolymorphicTypeValid…5.6
- CVE-2026-8356LibreOffice can import presentations in the legacy binary PP…5.4
- CVE-2026-83560The New User Approve WordPress plugin before 3.2.10 does not…5.3
- CVE-2026-83561The Complianz GDPR/CCPA Cookie Consent Banner plugin for Wor…7.2
Are you affected by CVE-2026-83550?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST