Critical Security Update for PostgreSQL 18: Multiple Vulnerabilities Addressed
Summary
ALSA-2026:67280: Important: postgresql18 security update. Affects postgresql18 versions < 18.6-1.el10_2. Fixed in 18.6-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced Object-Relational Database Management System (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of applications and is widely used in enterprise environments. The recent vulnerabilities identified in PostgreSQL 18 pose significant risks, including arbitrary code execution and SQL injection, which could compromise the integrity and security of database systems.
Vulnerability Detail
The vulnerabilities in PostgreSQL 18 include SQL injection in pg_createsubscriber, which allows arbitrary SQL execution as a superuser (CVE-2026-6476), and multiple instances of arbitrary code execution through various functions and plugins. These vulnerabilities can lead to unauthorized access, data manipulation, and potential system compromise, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
18.6-1.el10_2
This is the first release that contains the fix.
sudo dnf update postgresql18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the PostgreSQL server and limit the execution of untrusted data until the update is applied. This can be done by modifying the pg_hba.conf file to enforce stricter authentication methods.
Conclusion
The vulnerabilities identified in PostgreSQL 18 present serious security risks that require immediate attention. Users are strongly advised to update their packages to the latest patched version to mitigate these risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for postgresql18 →
FAQ
The vulnerabilities include SQL injection and arbitrary code execution through various functions, which can lead to unauthorized access and data manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, consider implementing access restrictions and monitoring database activity for any suspicious behavior.
Detailed information about the vulnerabilities can be found on the respective CVE pages linked in the advisory.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql18.
