Untrusted Search Path Issue in PostgreSQL vacuumdb Tool
CVE-2026-116313

7.2HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-116313?

The PostgreSQL vacuumdb tool contains an untrusted search path vulnerability that allows database owners to execute arbitrary SQL code. This issue arises due to the use of shadowing operators in the --missing-stats-only catalog query, which can be exploited if not properly configured. The compromised execution could lead to unauthorized database access or manipulation. Users of versions 18.0 to 18.6 are encouraged to upgrade to version 18.7 or later to mitigate this security risk.

Affected Version(s)

PostgreSQL 18 < 18.7

References

https://www.postgresql.org/support/security/CVE-2026-116313/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Anthropic OSS program for reporting this problem.
.