CVE-2026-18408
Description
A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pg_dump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim processes this manipulated dump, the injected code executes with the privileges of the operating system account running the psql client.
Statement
An Important-rated vulnerability in PostgreSQL allows a malicious superuser on an origin server to compromise client systems during a database restore. By injecting arbitrary code into a database dump, the attacker can trigger execution when the file is processed by a victim's psql client. This runs the malicious code with the operating system privileges of the user performing the restore, effectively escalating access from the compromised database server to the client machine.
Mitigation
To mitigate this vulnerability, administrators should avoid generating or restoring pg_dump files from untrusted or public origin servers using the psql client. If restoring a plain-format dump from an unverified source is strictly necessary, manually inspect the file for unauthorized \restrict or \unrestrict meta-commands before execution, or isolate the restore process in a sandboxed environment
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.4 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or permissions to the untrusted functionality, DOM-based XSS vulnerabilities, stealing user's cookies, open redirect to malware (CWE-601), etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
