File Control Vulnerability in PostgreSQL By Product Vendor
CVE-2026-14661

8.1HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-14661?

A vulnerability in PostgreSQL's dblink and subscription handling allows unauthorized users to control file names used by the 'sslkeylogfile' parameter. This can lead to persistent denial of service by manipulating data appended to a specified file. The flaw exists in major version 18 and earlier versions if libpq version 18 or later is in use. Affected versions before PostgreSQL 18.7 are particularly at risk, exposing systems to potential service disruptions through invalid data injections.

Affected Version(s)

PostgreSQL 18 < 18.7

PostgreSQL 17 < 17.12

PostgreSQL 16 < 16.16

References

https://www.postgresql.org/support/security/CVE-2026-14661/

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Andrey Krasichkov, b.altawil, and Zsolt Parragi for reporting this problem.
.