SQL Injection Vulnerability in PostgreSQL 17 and 18 Affecting ALTER SUBSCRIPTION Command

postgresql17 Updated 15 May 2026

Summary

14/05/2026

Disclosed on

N/A

Severity

Yes i

Fix available

Low

Severity

3.7

CVSS Score

ALPINE-CVE-2026-6638: SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... Affects postgresql17 versions < 17.10-r0. Fixed in 17.10-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

PostgreSQL is a powerful, open-source object-relational database system known for its robustness, extensibility, and standards compliance. It supports a wide variety of workloads, from single machines to data warehouses or web services with many concurrent users. The vulnerability in question affects the ALTER SUBSCRIPTION command, which is used in logical replication to manage subscriptions to publications. This vulnerability allows unauthorized SQL execution under certain conditions, posing a significant risk to database integrity.

Vulnerability Detail

The vulnerability identified as CVE-2026-6638 is an SQL injection flaw that occurs during the execution of the ALTER SUBSCRIPTION command in PostgreSQL's logical replication feature. This flaw allows a subscriber table creator to execute arbitrary SQL commands using the credentials of the subscription's publication side. The attack is triggered during the next REFRESH PUBLICATION operation, which can lead to unauthorized data manipulation or exposure. The affected versions include PostgreSQL 16, 17, and 18, specifically those prior to versions 18.4, 17.10, and 16.14. Versions before PostgreSQL 16 are not affected.

How To Fix

Minimum fixed version

17.10-r0

This is the first release that contains the fix.

sudo apk add --upgrade postgresql17

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, consider restricting access to the ALTER SUBSCRIPTION command to trusted users only. This can help mitigate the risk of exploitation until the package is updated. Additionally, review and audit the permissions granted to users who can create subscriber tables.

Conclusion

The SQL injection vulnerability CVE-2026-6638 in PostgreSQL poses a significant risk to database integrity through unauthorized SQL execution. It is crucial to update to the latest patched versions of PostgreSQL to mitigate this risk. Users should also consider implementing access restrictions as a temporary workaround.

See every vulnerability recorded for postgresql17 →