SQL Injection Vulnerability in PostgreSQL reindexdb Affects Multiple Versions
CVE-2026-116325

8HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-116325?

A SQL injection vulnerability exists in the reindexdb utility of PostgreSQL, allowing an object creator to execute arbitrary SQL commands as the database user. This issue is triggered through a specially crafted index name embedded in the parallel catalog query, particularly during operations executed with the --jobs and --index flags. The impact is specifically noted in PostgreSQL versions 17 and 18, with minor versions prior to 18.7 and 17.12 being affected, while earlier major versions remain unaffected. The nature of this vulnerability highlights potential risks for database integrity and necessitates immediate attention from database administrators.

Affected Version(s)

PostgreSQL 18 < 18.7

PostgreSQL 17 < 17.12

References

https://www.postgresql.org/support/security/CVE-2026-116325/

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Anthropic OSS program for reporting this problem.
.