Critical Security Update for pg_repack and Related Packages: CVE-2026-6473, CVE-2026-6475, CVE-2026-6477, CVE-2026-6478
Summary
RHSA-2026:28037: Red Hat Security Advisory: postgresql:15 security update. Affects pg_repack versions < 0:1.4.8-2.module+el9.8.0+24091+17775505. Fixed in 0:1.4.8-2.module+el9.8.0+24091+17775505. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pg_repack is a PostgreSQL extension that allows for the reorganization of tables and indexes to reclaim disk space and improve performance. It is widely used in database management to optimize storage and enhance query performance. However, recent vulnerabilities have been identified that could potentially allow unauthorized access or data manipulation, making it crucial for users to address these issues promptly.
Vulnerability Detail
The vulnerabilities identified in pg_repack and related packages stem from improper handling of certain inputs, which could lead to unauthorized access or data corruption. The vulnerabilities are tracked under CVE-2026-6473, CVE-2026-6475, CVE-2026-6477, and CVE-2026-6478. The ramifications of these vulnerabilities are severe, as they could allow attackers to exploit the database, leading to data breaches or loss of integrity. The CVSS score for this vulnerability is 8.8, indicating a high level of risk.
How To Fix
Minimum fixed version
0:1.4.8-2.module+el9.8.0+24091+17775505
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the database and limit the privileges of users until the packages are updated. This can be done by modifying the PostgreSQL configuration files to enforce stricter access controls.
Conclusion
In summary, the vulnerabilities in pg_repack and related packages pose a significant risk to database security. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Temporary workarounds can be implemented, but they should not replace the need for a proper update.
See every vulnerability recorded for pg_repack →
FAQ
The main vulnerabilities include improper input handling that could lead to unauthorized access and data corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high level of risk.
If immediate updates are not possible, restrict database access and limit user privileges as a temporary workaround.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:28037.json.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
