SQL Injection Vulnerability in PostgreSQL Packages: PostgreSQL 17 and 18
Summary
ALPINE-CVE-2026-6476: SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. Affects postgresql17 versions < 17.10-r0. Fixed in 17.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, certain versions of PostgreSQL, specifically versions 17 and 18 before 17.10 and 18.4 respectively, are vulnerable to an SQL injection flaw in the pg_createsubscriber function, which can allow attackers to execute arbitrary SQL commands with superuser privileges.
Vulnerability Detail
The vulnerability arises from an SQL injection in the pg_createsubscriber function of PostgreSQL. An attacker with pg_create_subscription rights can exploit this flaw to execute arbitrary SQL commands as a superuser. This can lead to severe consequences, including unauthorized data access, data manipulation, or even complete control over the database. The vulnerability is triggered when pg_createsubscriber is executed, making it crucial for users to be aware of their subscription rights and the versions they are using.
How To Fix
Minimum fixed version
17.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the pg_create_subscription rights to trusted users only, minimizing the risk of exploitation until the packages are updated.
Conclusion
In summary, the SQL injection vulnerability in PostgreSQL's pg_createsubscriber function poses significant risks to database security. Users are strongly advised to update their PostgreSQL packages to the latest patched versions to safeguard against potential exploitation.
See every vulnerability recorded for postgresql17 →
FAQ
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
PostgreSQL versions 17 and 18, specifically minor versions before 17.10 and 18.4, are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access, data manipulation, or complete control over the database, posing significant risks to data integrity and security.
If immediate updates are not possible, restrict pg_create_subscription rights to trusted users as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql17.
