Read the docs
TI-2026-05675 Aliases CVE-2026-6475GHSA-7h2q-899j-9636

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Priority MEDIUM 40CWE-61Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 19 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Fix Partial PostgreSQL: 18.4, 17.10, 16.14 +2Red Hat: 33 advisoriesRed Hat: 19 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL18 to before 18.4; 17 to before 17.10; 16 to before 16.14; 15 to before 15.18; before 14.2318.4, 17.10, 16.14, 15.18, 14.23Patch availableCNA
  • PostgreSQL Vendor— Affected 18 to before 18.4; 17 to before 17.10; 16 to before 16.14; 15 to before 15.18; before 14.23 Fixed in 18.4, 17.10, 16.14, 15.18, 14.23 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*before 14.23; 15.0 to before 15.18; 16.0 to before 16.14; 17.0 to before 17.10; 18.0 to before 18.4VulnerablePostgreSQL
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions before 14.23; 15.0 to before 15.18; 16.0 to before 16.14; 17.0 to before 17.10; 18.0 to before 18.4 Vulnerable ·PostgreSQL

Remediation

  • Fix · CNA PostgreSQL Fixed in 18.4, 17.10, 16.14, 15.18, 14.23

Red Hat 33 advisories

  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:44481 Released 2026-07-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:44420 Released 2026-07-23 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libpq-13.23-1.el8_4.1, libpq-devel-13.23-1.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libpq-13.23-1.el8_4.1, libpq-devel-13.23-1.el8_4.1
Show 30 more Red Hat advisories
  • RHSA-2026:42555 Released 2026-07-21 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:35880 Released 2026-07-06 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libpq-13.23-1.el8_8.1, libpq-devel-13.23-1.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libpq-13.23-1.el8_8.1, libpq-devel-13.23-1.el8_8.1
  • RHSA-2026:34362 Released 2026-07-01 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
  • RHSA-2026:34363 Released 2026-07-01 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
  • RHSA-2026:34043 Released 2026-07-01 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
  • RHSA-2026:33497 Released 2026-06-30 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2026:33441 Released 2026-06-30 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2026:32983 Released 2026-06-29 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2026:32994 Released 2026-06-29 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:29953 Released 2026-06-25 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) postgresql-13.23-1.el9_2.2, postgresql-contrib-13.23-1.el9_2.2, postgresql-plperl-13.23-1.el9_2.2 +5
  • RHSA-2026:29904 Released 2026-06-25 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) postgresql-13.23-1.el9_4.2, postgresql-contrib-13.23-1.el9_4.2, postgresql-plperl-13.23-1.el9_4.2 +5
  • RHSA-2026:29815 Released 2026-06-25 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
  • RHSA-2026:29212 Released 2026-06-25 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) postgresql-docs-13.23-1.el9_6.2, postgresql-private-devel-13.23-1.el9_6.2, postgresql-server-devel-13.23-1.el9_6.2 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) postgresql-13.23-1.el9_6.2, postgresql-contrib-13.23-1.el9_6.2, postgresql-plperl-13.23-1.el9_6.2 +5
  • RHSA-2026:28999 Released 2026-06-24 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.s390x::postgresql:12 +47
  • RHSA-2026:28208 Released 2026-06-23 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13 +47
  • RHSA-2026:28143 Released 2026-06-23 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.s390x::postgresql:16 +47
  • RHSA-2026:28037 Released 2026-06-22 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.s390x::postgresql:15 +47
  • RHSA-2026:27741 Released 2026-06-22 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.23-3.el9_8, postgresql-contrib-13.23-3.el9_8, postgresql-plperl-13.23-3.el9_8 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) postgresql-docs-13.23-3.el9_8, postgresql-private-devel-13.23-3.el9_8, postgresql-server-devel-13.23-3.el9_8 +4
  • RHSA-2026:27742 Released 2026-06-22 · Red Hat rating Important
    postgresql18 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql18-18.4-1.el10_2, postgresql18-contrib-18.4-1.el10_2, postgresql18-docs-18.4-1.el10_2 +10
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql18-test-rpm-macros-18.4-1.el10_2
  • RHSA-2026:27743 Released 2026-06-22 · Red Hat rating Important
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql-16.14-1.el10_2, postgresql-contrib-16.14-1.el10_2, postgresql-docs-16.14-1.el10_2 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql-test-rpm-macros-16.14-1.el10_2
  • RHSA-2026:27718 Released 2026-06-22 · Red Hat rating Important
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) postgresql-16.14-1.el10_0, postgresql-contrib-16.14-1.el10_0, postgresql-docs-16.14-1.el10_0 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) postgresql-test-rpm-macros-16.14-1.el10_0
  • RHSA-2026:27738 Released 2026-06-22 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpq-13.23-2.el8_10, libpq-devel-13.23-2.el8_10
  • RHSA-2026:26561 Released 2026-06-17 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15 +36
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15, pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15 +19
  • RHSA-2026:26525 Released 2026-06-17 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47
  • RHSA-2026:26524 Released 2026-06-17 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.aarch64::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.ppc64le::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.s390x::postgresql:16 +47
  • RHSA-2026:26204 Released 2026-06-16 · Red Hat rating Important
    postgresql:18 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18, pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18, pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18 +47
  • RHSA-2026:26203 Released 2026-06-16 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.s390x::postgresql:16 +47
  • RHSA-2026:26181 Released 2026-06-16 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
  • RHSA-2026:22878 Released 2026-06-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images postgresql-18.4-0.1.hum1@aarch64, postgresql-18.4-0.1.hum1@x86_64, postgresql-contrib-18.4-0.1.hum1@aarch64 +26
  • RHSA-2026:21182 Released 2026-05-26 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images postgresql17-17.10-0.1.hum1@aarch64, postgresql17-17.10-0.1.hum1@src, postgresql17-17.10-0.1.hum1@x86_64 +28

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 14.23, 15.18 and 3 more versions

    8 records Highest priority Priority MEDIUM 5 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-05673 PostgreSQL server undersizes allocations, via integer wraparoundPriority MEDIUM 42
    • TI-2026-05824 PostgreSQL refint allows stack buffer overflow and SQL injectionPriority MEDIUM 40
    • TI-2026-05679 PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursionPriority MEDIUM 40
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Self-service automation portal 2AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:29212
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:27742, RHSA-2026:27743
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:26181, RHSA-2026:27738, RHSA-2026:28143, RHSA-2026:28208, RHSA-2026:28999
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:26203, RHSA-2026:26204, RHSA-2026:27741, RHSA-2026:28037
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:34362, RHSA-2026:34363, RHSA-2026:44420
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:29815, RHSA-2026:32994
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:26561, RHSA-2026:34043, RHSA-2026:35880, RHSA-2026:42555
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:29953, RHSA-2026:33497
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:26524, RHSA-2026:29904, RHSA-2026:33441
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:27718
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:26525, RHSA-2026:29212, RHSA-2026:32983
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:34362, RHSA-2026:34363, RHSA-2026:44420
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:29815, RHSA-2026:32994
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:26561, RHSA-2026:34043, RHSA-2026:35880, RHSA-2026:42555
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:27742, RHSA-2026:27743
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:27741
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:27718
Red Hat Hardened ImagesFixed RHSA-2026:21182, RHSA-2026:22878
Red Hat Update Infrastructure 5Fixed RHSA-2026:44481, RHSA-2026:58981
Not affected: 4 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6475
  2. 2026-10-03 Alias added: GHSA-7h2q-899j-9636

References

Patch 1

  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
  • TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
  • TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
  • TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences