Privilege escalation via unpinned search_path

Privilege escalation in CloudNativePG before 1.28.4 and 1.29.2 allows remote authenticated users to gain PostgreSQL superuser access via crafted search_path settings. The instance manager opens superuser connections without pinning search_path, so introspection queries that use unqualified operators such as = and > can resolve attacker-planted operator overloads in the public schema and run them as the cluster postgres superuser. Exploitation requires a role with DATABASE OWNER on a managed database; successful exploitation can extend to command execution in the database pod through COPY ... FROM PROGRAM and exposure of the pod ServiceAccount token.