Critical SQL Injection and Code Execution Vulnerabilities in PostgreSQL 18
Summary
RLSA-2026:67280: Important: postgresql18 security update. Affects postgresql18 versions < 0:18.6-1.el10_2. Fixed in 0:18.6-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced Object-Relational Database Management System (DBMS) known for its robustness and extensibility. It supports a wide range of data types and offers powerful features such as complex queries, transactions, and concurrency control. However, recent vulnerabilities have been identified in version 18, which could allow attackers to execute arbitrary SQL commands and potentially gain superuser access, compromising the integrity and confidentiality of the database.
Vulnerability Detail
The vulnerabilities stem from multiple sources, including SQL injection flaws in the pg_createsubscriber function and arbitrary code execution through integer wraparound in various functions. These vulnerabilities can lead to unauthorized access, data manipulation, and system compromise. The most critical issues include SQL injection that allows arbitrary SQL execution as a superuser and arbitrary code execution via untrusted data inclusion in pg_dump, which can be exploited by attackers to execute malicious code.
How To Fix
Minimum fixed version
0:18.6-1.el10_2
This is the first release that contains the fix.
sudo dnf update postgresql18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the PostgreSQL server and limit the execution of untrusted commands. Additionally, consider disabling features that allow untrusted data execution until the package is updated.
Conclusion
In summary, the recent vulnerabilities in PostgreSQL 18 pose significant risks, including SQL injection and arbitrary code execution. It is crucial to update to the patched version to safeguard your database. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for postgresql18 →
FAQ
The CVSS score of the vulnerability is 8.8, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerabilities can lead to unauthorized access, data manipulation, and system compromise, potentially allowing attackers to execute arbitrary code.
Yes, you can restrict access to the PostgreSQL server and disable features that allow untrusted data execution as a temporary workaround.
If immediate updates are not possible, ensure that your database is not exposed to untrusted networks and monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql18.
