Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-05-14T13:00:11 postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CWE-59

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pg_basebackup (plain format) and pg_rewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical implications if specific actions are taken, such as moving files to a different virtual machine (VM) or snapshotting the VM, between the execution of these commands and the server's restart.

This MODERATE symlink following vulnerability in PostgreSQL's pg_basebackup and pg_rewind allows an origin superuser to overwrite local files. Exploitation requires local access, high privileges (superuser), and specific intermediate actions before server restart. Impact is high to confidentiality, integrity, and availability if exploited. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23. Red Hat Enterprise Linux 10 2026-06-22T00:00:00Z RHSA-2026:27742 postgresql18-0:18.4-1.el10_2 Red Hat Enterprise Linux 10 2026-06-22T00:00:00Z RHSA-2026:27743 postgresql16-0:16.14-1.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-06-22T00:00:00Z RHSA-2026:27718 postgresql16-0:16.14-1.el10_0 Red Hat Enterprise Linux 8 2026-06-16T00:00:00Z RHSA-2026:26181 postgresql:15-8100020260605152259.489197e6 Red Hat Enterprise Linux 8 2026-06-22T00:00:00Z RHSA-2026:27738 libpq-0:13.23-2.el8_10 Red Hat Enterprise Linux 8 2026-06-23T00:00:00Z RHSA-2026:28143 postgresql:16-8100020260530205218.489197e6 Red Hat Enterprise Linux 8 2026-06-23T00:00:00Z RHSA-2026:28208 postgresql:13-8100020260605152256.489197e6 Red Hat Enterprise Linux 8 2026-06-24T00:00:00Z RHSA-2026:28999 postgresql:12-8100020260605152253.489197e6 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-01T00:00:00Z RHSA-2026:34362 postgresql:12-8040020260624104459.522a0ee4 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-01T00:00:00Z RHSA-2026:34363 postgresql:13-8040020260630100922.522a0ee4 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-23T00:00:00Z RHSA-2026:44420 libpq-0:13.23-1.el8_4.1 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-01T00:00:00Z RHSA-2026:34362 postgresql:12-8040020260624104459.522a0ee4 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-01T00:00:00Z RHSA-2026:34363 postgresql:13-8040020260630100922.522a0ee4 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-23T00:00:00Z RHSA-2026:44420 libpq-0:13.23-1.el8_4.1 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-06-25T00:00:00Z RHSA-2026:29815 postgresql:12-8060020260623094704.ad008a3a Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-06-29T00:00:00Z RHSA-2026:32994 postgresql:13-8060020260625065744.ad008a3a Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-06-25T00:00:00Z RHSA-2026:29815 postgresql:12-8060020260623094704.ad008a3a Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-06-29T00:00:00Z RHSA-2026:32994 postgresql:13-8060020260625065744.ad008a3a Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-06-17T00:00:00Z RHSA-2026:26561 postgresql:15-8080020260615085052.63b34585 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-01T00:00:00Z RHSA-2026:34043 postgresql:12-8080020260626093604.63b34585 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-06T00:00:00Z RHSA-2026:35880 libpq-0:13.23-1.el8_8.1 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-21T00:00:00Z RHSA-2026:42555 postgresql:13-8080020260709122729.63b34585 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-06-17T00:00:00Z RHSA-2026:26561 postgresql:15-8080020260615085052.63b34585 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-01T00:00:00Z RHSA-2026:34043 postgresql:12-8080020260626093604.63b34585 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-06T00:00:00Z RHSA-2026:35880 libpq-0:13.23-1.el8_8.1 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-21T00:00:00Z RHSA-2026:42555 postgresql:13-8080020260709122729.63b34585 Red Hat Enterprise Linux 9 2026-06-16T00:00:00Z RHSA-2026:26203 postgresql:16-9080020260605131007.rhel9 Red Hat Enterprise Linux 9 2026-06-16T00:00:00Z RHSA-2026:26204 postgresql:18-9080020260605125734.rhel9 Red Hat Enterprise Linux 9 2026-06-22T00:00:00Z RHSA-2026:27741 postgresql-0:13.23-3.el9_8 Red Hat Enterprise Linux 9 2026-06-22T00:00:00Z RHSA-2026:28037 postgresql:15-9080020260605124405.rhel9 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-06-25T00:00:00Z RHSA-2026:29953 postgresql-0:13.23-1.el9_2.2 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-06-30T00:00:00Z RHSA-2026:33497 postgresql:15-9020020260625101129.rhel9 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-06-17T00:00:00Z RHSA-2026:26524 postgresql:16-9040020260612132455.rhel9 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-06-25T00:00:00Z RHSA-2026:29904 postgresql-0:13.23-1.el9_4.2 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-06-30T00:00:00Z RHSA-2026:33441 postgresql:15-9040020260616071806.rhel9 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-17T00:00:00Z RHSA-2026:26525 postgresql:16-9060020260612084605.rhel9 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-25T00:00:00Z RHSA-2026:29212 postgresql-0:13.23-1.el9_6.2 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-29T00:00:00Z RHSA-2026:32983 postgresql:15-9060020260622062902.rhel9 Red Hat Hardened Images 2026-05-26T00:00:00Z RHSA-2026:21182 postgresql17-main-17.10-0.1.hum1 Red Hat Hardened Images 2026-06-03T00:00:00Z RHSA-2026:22878 postgresql18-main-18.4-0.1.hum1 Red Hat Update Infrastructure 5 2026-07-23T00:00:00Z RHSA-2026:44481 rhui5/rhua-rhel9:1784795076 Red Hat Enterprise Linux 6 Out of support scope postgresql Red Hat Enterprise Linux 7 Not affected postgresql Red Hat Enterprise Linux 8 Not affected postgresql Red Hat Enterprise Linux 8 Not affected postgresql-jdbc Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-6475 https://nvd.nist.gov/vuln/detail/CVE-2026-6475 https://www.postgresql.org/support/security/CVE-2026-6475/