CVE-2026-116325
Description
A flaw was found in PostgreSQL's reindexdb utility. An authenticated database user with privileges to create objects can execute arbitrary SQL commands with the permissions of the database user running the utility. This issue occurs when crafted index names are improperly sanitized during parallel catalog queries when reindexdb is executed with the --jobs and --index options.
Statement
This vulnerability is rated as having an Important impact because an authenticated user with object creation privileges can escalate permissions to execute arbitrary SQL commands under the administrative identity running maintenance tasks. Exploitation requires an administrator to run the reindexdb utility specifying both parallel worker jobs and individual index targets against a database containing malicious index names. PostgreSQL deployments on versions prior to 17 do not include parallel catalog query logic in this utility and are not affected.
Mitigation
Avoid combining parallel execution with index targeting when running the reindexdb utility, or invoke reindexing operations directly via SQL.
1. Execute reindexdb sequentially without the parallel worker flag (`-j` / `--jobs`):
reindexdb -d <database_name> --index <index_name>
2. Alternatively, perform the reindex operation directly through a psql session:
REINDEX INDEX <index_name>;
Caveat: Performing index maintenance sequentially instead of concurrently across multiple worker jobs may prolong maintenance tasks on large databases.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8 | N/A | 8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Adversaries could execute system commands, typically by changing the SQL statement to redirect output to a file that can then be executed.
Confidentiality
Technical Impact: Read Application Data
Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities.
Authentication
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
If poor SQL commands are used to check user names and passwords or perform other kinds of authentication, it may be possible to connect to the product as another user with no previous knowledge of the password.
Access Control
Technical Impact: Bypass Protection Mechanism
If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability.
Integrity
Technical Impact: Modify Application Data
Just as it may be possible to read sensitive information, it is also possible to modify or even delete this information with a SQL injection attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
