CVE-2026-18408
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Risk Assessment
A malicious superuser of the source server could execute arbitrary code on the client during restore, potentially leading to compromise of the client account and data security.
Recommendation
It is recommended to upgrade PostgreSQL to version 18.6, 17.11, 16.15, 15.19, or 14.24 or later to address this vulnerability.
Other vulnerabilities in PostgreSQL
See all- CVE-2017-15098High
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.
- CVE-2017-7548High
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
- CVE-2017-7547High
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers to retrieve passwords from user mappings defined by foreign server owners without actually having the privileges to do so.
- CVE-2017-7484High
Some selectivity estimation functions in PostgreSQL before version 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, potentially leaking data. An unprivileged attacker could exploit this flaw to steal information from tables they would otherwise not have access to.
- CVE-2016-5424High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 may allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges through mishandling of special characters in database or role names.
- CVE-2016-5423High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
- CVE-2016-2193High
PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions.
- CVE-2016-0773High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 are vulnerable to remote attacks that can lead to denial of service via an infinite loop or buffer overflow.
- CVE-2016-0766High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 do not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, allowing attackers to gain privileges via unspecified vectors.
- CVE-2024-10976Medium
Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.
Original NVD description (English source)
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS