PostgreSQL Privilege Escalation Vulnerability - CVE-2022-1552

postgresql Updated 02 Oct 2025

Summary

31/08/2022

Disclosed on

N/A

Severity

Yes i

Fix available

High

Severity

8.8

CVSS Score

ALPINE-CVE-2022-1552: A flaw was found in PostgreSQL. Affects postgresql versions < 13.7-r0. Fixed in 13.7-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

PostgreSQL is a powerful, open-source relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, it is susceptible to vulnerabilities that can compromise its security. CVE-2022-1552 is a significant vulnerability that affects multiple versions of PostgreSQL, allowing attackers to execute arbitrary SQL functions with superuser privileges under certain conditions.

Vulnerability Detail

CVE-2022-1552 is a flaw in PostgreSQL that arises from incomplete safety measures when a privileged user manages another user's objects. Specifically, commands such as Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck fail to activate necessary protections in a timely manner. This oversight permits an attacker, who has permission to create non-temporary objects in at least one schema, to execute arbitrary SQL functions as a superuser, potentially leading to unauthorized access and manipulation of sensitive data.

How To Fix

Minimum fixed version

13.7-r0

This is the first release that contains the fix.

sudo apk add --upgrade postgresql

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, restrict permissions for users who can create non-temporary objects in schemas until the package is updated. This can be done by reviewing and adjusting user roles and privileges in PostgreSQL.

Conclusion

CVE-2022-1552 is a critical vulnerability in PostgreSQL that can lead to privilege escalation. It is crucial for users to update their PostgreSQL installations to the patched versions to safeguard against potential exploitation. Additionally, implementing temporary workarounds can help mitigate risks until updates are applied.

See every vulnerability recorded for postgresql →