CVE-2026-6638
Description
A flaw was found in PostgreSQL. This SQL injection vulnerability exists within the logical replication feature, specifically when using the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command. A malicious subscriber table creator can exploit this flaw to execute arbitrary SQL commands with the elevated privileges of the subscription's publication-side credentials. The attack is triggered when the REFRESH PUBLICATION command is next executed.
Statement
SQL injection in PostgreSQL logical replication allows a subscriber-side table creator to execute arbitrary SQL on the publisher using the subscription's publication-side credentials. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates subscriber-side schema and relation names into SQL sent to the publisher without properly quoting them; a crafted relation name can therefore inject arbitrary SQL that runs with the privileges of the subscription's publication-side role the next time REFRESH PUBLICATION is executed. Exploitation requires the attacker to already hold table-creation privileges on the subscriber database, for logical replication to be configured with an untrusted subscriber-side user, and for a privileged user to subsequently run REFRESH PUBLICATION, which limits the practical attack surface for most default deployments. Only PostgreSQL major versions 16, 17, and 18 are affected; versions prior to 16 do not include the vulnerable code path (introduced by commit 875693019053b8897ec3983e292acbb439b088c3).
Mitigation
Upgrade to PostgreSQL 18.4, 17.10, or 16.14 (matching your major version) or later, which corrects the identifier quoting used when the subscriber's apply worker sends the REFRESH PUBLICATION SQL to the publisher. Versions prior to PostgreSQL 16 are not affected. As a temporary mitigation, restrict CREATE TABLE / table-ownership privileges on subscriber databases to trusted roles only, avoid configuring logical replication subscriptions for untrusted subscriber-side users, and scope the subscription's publication-side credentials to the minimum privileges necessary.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | 8.8 | 3.7 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | Low | Low | Low |
| User Interaction | Required | None | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | High | Low |
| Integrity Impact | Low | High | Low |
| Availability Impact | None | High | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Adversaries could execute system commands, typically by changing the SQL statement to redirect output to a file that can then be executed.
Confidentiality
Technical Impact: Read Application Data
Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities.
Authentication
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
If poor SQL commands are used to check user names and passwords or perform other kinds of authentication, it may be possible to connect to the product as another user with no previous knowledge of the password.
Access Control
Technical Impact: Bypass Protection Mechanism
If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability.
Integrity
Technical Impact: Modify Application Data
Just as it may be possible to read sensitive information, it is also possible to modify or even delete this information with a SQL injection attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
