Untrusted Data Inclusion Vulnerability in PostgreSQL by PostgreSQL Global Development Group
CVE-2026-116330

8.8HIGH

Key Information:

Vendor

PostgreSQL Global Development Group

Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-116330?

This vulnerability in PostgreSQL pg_dump allows untrusted data inclusion through a vulnerable process in the tar-format restoration of the 'restore.sql' file. A compromised origin server could exploit this issue to execute arbitrary code as the user account running psql. The vulnerability exists due to a predictable restriction key in restore.sql and represents an incomplete fix for a previous issue. The undocumented nature of restore.sql further complicates mitigation efforts. Users of versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are recommended to upgrade to address this security risk.

Affected Version(s)

PostgreSQL 18 < 18.7

PostgreSQL 17 < 17.12

PostgreSQL 16 < 16.16

References

https://www.postgresql.org/support/security/CVE-2026-116330/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Pavel Kopylov for reporting this problem.
.