Critical Security Vulnerability in PostgreSQL Packages: RHSA-2026:72282
Summary
RHSA-2026:72282: Red Hat Security Advisory: postgresql16 security update. Affects postgresql versions < 0:16.15-1.el10_0. Fixed in 0:16.15-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, robustness, and performance. The recent security advisory RHSA-2026:72282 highlights vulnerabilities in various PostgreSQL packages, including postgresql, postgresql-contrib, and others, which could potentially expose systems to significant risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified in the PostgreSQL packages stem from multiple issues that could allow attackers to exploit the system. These vulnerabilities include potential data exposure and unauthorized access, which could lead to data integrity issues and system compromise. The vulnerabilities are classified under CVE identifiers such as CVE-2026-14662 and CVE-2026-15742, with a CVSS score of 8.8, indicating a high severity level. Attackers could leverage these vulnerabilities to execute arbitrary code, leading to severe consequences for affected systems.
How To Fix
Minimum fixed version
0:16.15-1.el10_0
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the PostgreSQL server by modifying the pg_hba.conf file to limit connections to trusted IP addresses only. This can help mitigate the risk until the packages are updated.
Conclusion
The vulnerabilities identified in the PostgreSQL packages pose significant risks to systems using these packages. It is crucial to update to the patched version 0:16.15-1.el10_0 to mitigate these risks. Implementing workarounds can provide temporary relief, but timely updates are essential for maintaining system security.
See every vulnerability recorded for postgresql →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing network restrictions and monitoring for any suspicious activity as a temporary workaround.
Yes, several packages are affected, including postgresql, postgresql-contrib, postgresql-server, and others listed in the advisory.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:72282.json.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
