SQL Injection Vulnerability in PostgreSQL for Affected Versions
CVE-2026-120153

7.2HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-120153?

An SQL injection vulnerability exists in the PostgreSQL extension-script substitutions, which allows an attacker with database-level CREATE privileges to execute arbitrary code as the bootstrap superuser. This vulnerability is triggered through a schema or owner name that includes newlines or other special substrings. Unlike prior vulnerabilities, this issue specifically requires a non-bundled extension that matches certain vulnerable script patterns, impacting multiple versions prior to their respective security updates.

Affected Version(s)

PostgreSQL 18 < 18.7

PostgreSQL 17 < 17.12

PostgreSQL 16 < 16.16

References

https://www.postgresql.org/support/security/CVE-2026-120153/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Anthropic OSS program, Sven Klemm, and Aaron chen for reporting this problem.
.