SQL Injection Vulnerability in PostgreSQL pg_dump Affects Specific Versions
CVE-2026-116318

8.8HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-116318?

A vulnerability exists in PostgreSQL's pg_dump tool that allows an object creator to execute arbitrary SQL commands when restoring a dump. This occurs due to an inherited column that possesses a child-local not-null constraint, with a name requiring quoting. Specifically, this issue affects minor versions of PostgreSQL 18 before 18.7, enabling potential exploitation through improperly sanitized input during restoration. Ensure your PostgreSQL instances are updated to mitigate any risks associated with this vulnerability.

Affected Version(s)

PostgreSQL 18 < 18.7

References

https://www.postgresql.org/support/security/CVE-2026-116318/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Anthropic OSS program, Sarath Kumar, and Nikolay Samokhvalov for reporting this problem.
.